# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-26 21:52:41 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:49098: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 26 21:52:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 26 21:53:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
description:
2025-01-26 21:53:12 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:38889: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-26 21:53:53 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:52093: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.0.69.202
description:
Jan 26 21:53:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.0.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.0.69.202
description:
2025-01-26 21:53:46 dovecot_plain authenticator failed for 191-0-69-202.host.telemar.net.br [191.0.69.202]:36527: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
description:
2025-01-26 21:53:04 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:57069: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
description:
Jan 26 21:53:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Jan 26 21:53:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-01-26 21:53:35 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:50454: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-26 21:52:59 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:36559: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.45.206
description:
47.128.45.206 - - [26/Jan/2025:21:53:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18141339 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/6ac518?panel=cache" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.45.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.66
description:
Jan 26 21:53:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.66
description:
2025-01-26 21:53:16 dovecot_login authenticator failed for ([92.118.39.66]) [92.118.39.66]:50565: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.84.3
description:
[2025-01-26 21:53:33 +0100] info [webmaild] 37.239.84.3 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 26 21:53:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
description:
Jan 26 21:53:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 26 21:53:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-26 21:53:13 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:57649: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-26 21:53:15 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:55005: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 26 21:54:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 26 21:54:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.124.42
description:
Jan 26 21:54:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.124.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-26 21:54:07 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:55706: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.201.199.153
description:
Jan 26 21:54:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.201.199.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 26 21:54:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.99.54
description:
Jan 26 21:54:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
description:
Jan 26 21:53:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-26 21:54:52 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:51290: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.124.42
description:
2025-01-26 21:54:09 dovecot_plain authenticator failed for ([121.189.124.42]) [121.189.124.42]:56574: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
description:
Jan 26 21:54:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 26 21:54:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.8
description:
Jan 26 21:53:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.8 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.10.131
description:
[2025-01-26 21:54:17 +0100] info [webmaild] 177.36.10.131 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 26 21:54:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-26 21:54:24 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:56394: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.199.99.54
description:
2025-01-26 21:54:32 dovecot_login authenticator failed for (1224312.cloudwaysapps.com) [24.199.99.54]:54708: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.8
description:
2025-01-26 21:53:57 dovecot_plain authenticator failed for ([5.30.225.8]) [5.30.225.8]:58527: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-26 21:54:06 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:43134: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
description:
2025-01-26 21:54:16 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:16969: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.201.199.153
description:
2025-01-26 21:54:19 dovecot_login authenticator failed for ([118.201.199.153]) [118.201.199.153]:51330: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-26 21:54:21 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:51466: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Jan 26 21:54:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-01-26 21:54:27 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:48650: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
description:
2025-01-26 21:54:00 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:35392: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
description:
2025-01-26 21:55:39 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:36363: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 26 21:55:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 26 21:55:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
description:
2025-01-26 21:55:50 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:34928: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-26 21:55:11 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:44216: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
description:
Jan 26 21:55:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
description:
2025-01-26 21:55:31 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:45446: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
description:
Jan 26 21:55:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
description:
Jan 26 21:55:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.129.114
description:
2025-01-26 21:55:54 dovecot_login authenticator failed for ([14.48.129.114]) [14.48.129.114]:54804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-26 21:54:58 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:53841: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 26 21:55:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
description:
Jan 26 21:55:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
description:
Jan 26 21:55:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-26 21:55:07 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:27812: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
description:
2025-01-26 21:55:25 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:43960: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-26 21:55:26 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:48892: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
description:
Jan 26 21:55:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-26 21:55:41 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:39731: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
description:
2025-01-26 21:55:43 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:2338: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-26 21:55:47 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:46816: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 26 21:55:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-01-26 21:55:32 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:56520: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.219.157
description:
Jan 26 21:55:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.219.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 26 21:54:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.219.157
description:
2025-01-26 21:55:37 dovecot_login authenticator failed for ([94.205.219.157]) [94.205.219.157]:34571: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 26 21:55:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Jan 26 21:55:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 26 21:55:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
description:
Jan 26 21:56:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-26 21:56:05 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:34505: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-26 21:56:19 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:42008: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.240
description:
Jan 26 21:55:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-26 21:55:57 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:48282: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.240
description:
2025-01-26 21:56:00 dovecot_plain authenticator failed for 111-70-21-240.emome-ip.hinet.net [111.70.21.240]:44085: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 26 21:56:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.125.148
description:
[2025-01-26 21:56:30 +0100] info [webmaild] 179.48.125.148 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
description:
2025-01-26 21:57:14 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:48819: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.5
description:
[2025-01-26 21:57:45 +0100] info [whostmgrd] 156.228.80.5 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.208
description:
[2025-01-26 21:57:43 +0100] info [whostmgrd] 156.228.104.208 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.199
description:
[2025-01-26 21:57:46 +0100] info [whostmgrd] 156.228.117.199 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 21:57:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.158.118.171
description:
2025-01-26 21:57:02 dovecot_plain authenticator failed for (171-118-158-5.pride-net.ru) [5.158.118.171]:58742: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
description:
Jan 26 21:57:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.217.70.194
description:
[2025-01-26 21:57:39 +0100] info [webmaild] 196.217.70.194 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.54
description:
[2025-01-26 21:57:42 +0100] info [cpaneld] 104.207.56.54 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.158.118.171
description:
Jan 26 21:57:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.158.118.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.132
description:
[2025-01-26 21:57:38 +0100] info [cpaneld] 156.228.109.132 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.159
description:
[2025-01-26 21:57:39 +0100] info [cpaneld] 156.228.84.159 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.106
description:
[2025-01-26 21:57:42 +0100] info [cpaneld] 156.228.110.106 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.39
description:
[2025-01-26 21:57:43 +0100] info [whostmgrd] 156.228.93.39 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 134.209.104.67
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:21-57.134.209.104.67||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.116
description:
[2025-01-26 21:57:39 +0100] info [cpaneld] 156.228.91.116 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.103.85
description:
[2025-01-26 21:57:44 +0100] info [whostmgrd] 156.228.103.85 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 21:57:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.88.21
description:
[2025-01-26 21:57:45 +0100] info [whostmgrd] 156.228.88.21 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.216.72
description:
Jan 26 21:58:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.216.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.76
description:
2025-01-26 21:58:04 dovecot_login authenticator failed for ([104.241.228.76]) [104.241.228.76]:34738: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.175.120.25
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:21-58.83.175.120.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
description:
2025-01-26 21:58:28 dovecot_login authenticator failed for (92.62.243.174.fibermax.bg) [92.62.243.174]:35027: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
description:
Jan 26 21:58:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 26 21:58:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-26 21:58:16 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:10142: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-26 21:58:49 dovecot_login authenticator failed for ([175.210.74.19]) [175.210.74.19]:42174: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 26 21:58:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.76
description:
Jan 26 21:58:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-26 21:58:05 dovecot_login authenticator failed for ([211.57.111.99]) [211.57.111.99]:55240: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 26 21:58:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 21:58:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 21:58:09 ait sshd[2475261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.210.176
description:
Jan 26 21:58:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.210.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.210.176
description:
2025-01-26 21:58:41 dovecot_login authenticator failed for ([183.107.210.176]) [183.107.210.176]:38716: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-26 21:58:39 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:52643: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-26 21:58:55 dovecot_login authenticator failed for ([59.98.150.190]) [122.160.68.46]:55590: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-26 21:58:19 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:48074: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.216.72
description:
2025-01-26 21:58:30 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:56730: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 26 21:58:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Jan 26 21:58:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-01-26 21:58:49 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:55544: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 21:58:09 ait sshd[2475261]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 26 21:58:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 26 21:58:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 26 21:59:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-26 21:59:04 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:47660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
description:
2025-01-26 21:59:06 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:47794: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.137.248
description:
2025-01-26 21:59:21 dovecot_plain authenticator failed for ([60.191.137.248]) [60.191.137.248]:41340: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-26 21:59:26 dovecot_login authenticator failed for ([138.75.98.134]) [138.75.98.134]:33682: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
description:
Jan 26 21:59:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.157
description:
Jan 26 21:59:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 26 21:59:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
description:
Jan 26 21:58:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
description:
2025-01-26 21:58:59 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:43572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.66.235.99
description:
Jan 26 21:59:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.66.235.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.66.235.99
description:
2025-01-26 21:59:02 dovecot_plain authenticator failed for (valitae) [87.66.235.99]:50912: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.157
description:
2025-01-26 21:59:09 dovecot_plain authenticator failed for ([220.180.171.157]) [220.180.171.157]:60445: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 26 21:59:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 26 21:59:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
description:
2025-01-26 21:59:53 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:38208: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-26 21:59:17 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:59866: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.137.248
description:
Jan 26 21:59:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.137.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-26 21:59:43 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:57455: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
description:
Jan 26 21:59:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Jan 26 22:00:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-01-26 22:00:15 dovecot_login authenticator failed for ([116.114.97.10]) [116.114.97.10]:54798: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
description:
Jan 26 22:00:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-01-26 22:00:47 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:50948: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.48.118.55
description:
Jan 26 22:00:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.48.118.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 22:00:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-26 22:00:35 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:38402: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-26 22:00:38 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:43157: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 26 22:00:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-26 22:00:04 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:59799: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.48.118.55
description:
2025-01-26 22:00:07 dovecot_plain authenticator failed for ([42.48.118.55]) [42.48.118.55]:59967: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
description:
2025-01-26 22:00:31 dovecot_plain authenticator failed for (prere) [96.239.87.6]:45040: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 26 22:00:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 26 22:00:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Jan 26 22:00:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 26 22:00:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-26 22:00:08 dovecot_plain authenticator failed for (terible) [109.166.70.166]:14988: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
description:
Jan 26 22:00:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
description:
2025-01-26 22:00:29 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:50526: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Jan 26 22:01:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-01-26 22:01:34 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:49096: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 26 22:01:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-26 22:01:47 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:58649: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 26 22:02:51 ait sshd[2477547]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 26 22:02:51 ait sshd[2477547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
description:
Jan 26 22:02:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 26 22:02:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-26 22:02:16 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:46228: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 26 22:02:44 ait sshd[2477530]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
description:
2025-01-26 22:02:04 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:19394: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.155.182.176
description:
[2025-01-26 22:02:29 +0100] info [webmaild] 5.155.182.176 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 22:02:29 ait sshd[2477501]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 22:02:29 ait sshd[2477501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 26 22:02:44 ait sshd[2477530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-26 22:03:18 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:44872: 535 Incorrect authentication data (set_id=igonuotxre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.133.106
description:
Jan 26 22:02:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.133.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.133.106
description:
2025-01-26 22:03:01 dovecot_login authenticator failed for ([103.218.133.106]) [103.218.133.106]:47522: 535 Incorrect authentication data (set_id=igonuotxre@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 26 22:03:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-26 22:04:04 dovecot_login authenticator failed for ([59.98.150.190]) [122.160.68.46]:41492: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Jan 26 22:04:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-01-26 22:04:15 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:60467: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Jan 26 22:04:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
description:
2025-01-26 22:04:46 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:34160: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 26 22:04:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-26 22:04:58 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:57602: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 22:05:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 26 22:04:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.132.229.196
description:
2025-01-26 22:06:12 dovecot_login authenticator failed for ([185.132.229.196]) [185.132.229.196]:45699: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 26 22:06:22 ait sshd[2478933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 26 22:06:22 ait sshd[2478933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.132.229.196
description:
Jan 26 22:06:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.132.229.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Jan 26 22:06:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-01-26 22:06:29 dovecot_login authenticator failed for ([106.12.254.47]) [106.12.254.47]:6752: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.232.228
description:
[2025-01-26 22:06:47 +0100] info [webmaild] 177.72.232.228 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-26 22:06:58 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:38710: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
description:
Jan 26 22:07:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
description:
2025-01-26 22:07:43 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:39444: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.122.38.255
description:
[2025-01-26 22:07:47 +0100] info [webmaild] 187.122.38.255 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 26 22:06:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.153
description:
Jan 26 22:07:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.235.156.234
description:
[2025-01-26 22:07:08 +0100] info [webmaild] 189.235.156.234 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.153
description:
2025-01-26 22:07:10 dovecot_login authenticator failed for ([104.241.233.153]) [104.241.233.153]:48159: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 26 22:07:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-26 22:07:46 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:33608: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 26 22:07:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 26 22:07:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-26 22:07:58 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:1257: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-26 22:08:00 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:60330: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.220.183.227
description:
[2025-01-26 22:08:59 +0100] info [webmaild] 178.220.183.227 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-26 22:10:42 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:39807: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 26 22:10:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.90.250.141
description:
[2025-01-26 22:10:48 +0100] info [webmaild] 168.90.250.141 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 26 22:10:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-26 22:10:18 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:48654: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-26 22:11:21 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:38360: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.161.123
description:
Jan 26 22:11:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.161.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.67.59.65
description:
Jan 26 22:11:47 ait sshd[2481342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.67.59.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 26 22:11:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.227.80
description:
Jan 26 22:11:19 ait sshd[2481134]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.130.227.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.130.227.80
description:
Jan 26 22:11:19 ait sshd[2481134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.130.227.80  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.161.123
description:
2025-01-26 22:11:31 dovecot_login authenticator failed for ([93.182.161.123]) [93.182.161.123]:44806: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.67.59.65
description:
Jan 26 22:11:47 ait sshd[2481342]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.67.59.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-26 22:12:25 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:46578: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 22:12:41 ait sshd[2481877]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 26 22:12:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
description:
2025-01-26 22:12:05 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:36176: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.216
description:
2025-01-26 22:12:13 dovecot_login authenticator failed for ([195.178.110.216]) [195.178.110.216]:57466: 535 Incorrect authentication data (set_id=scanner)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 26 22:12:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 22:12:41 ait sshd[2481877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.191.5
description:
Jan 26 22:12:08 ait sshd[2481427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.191.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.191.5
description:
Jan 26 22:12:08 ait sshd[2481427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.191.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.216
description:
Jan 26 22:12:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 26 22:13:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-26 22:13:42 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.165.151
description:
[2025-01-26 22:13:52 +0100] info [webmaild] 90.156.165.151 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.113.183.73
description:
2025-01-26 22:13:52 dovecot_login authenticator failed for ([74.113.183.73]) [74.113.183.73]:52173: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 26 22:13:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-26 22:13:30 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:44378: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 22:13:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.215
description:
Jan 26 22:13:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.215
description:
2025-01-26 22:13:17 dovecot_login authenticator failed for ([195.178.110.215]) [195.178.110.215]:61577: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 26 22:13:33 ait sshd[2482088]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 26 22:13:33 ait sshd[2482088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Jan 26 22:14:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-26 22:14:19 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:32171: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 26 22:14:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.158.76.244
description:
Jan 26 22:14:26 ait sshd[2482457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.158.76.244  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 26 22:14:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
description:
Jan 26 22:14:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-01-26 22:14:13 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:59622: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 26 22:14:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-26 22:14:28 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:46880: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 22:14:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-01-26 22:14:06 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:34708: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
description:
2025-01-26 22:14:11 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:52350: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-26 22:15:36 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:47912: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.216.72
description:
Jan 26 22:15:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.216.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 26 22:15:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.216.72
description:
2025-01-26 22:15:53 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:53891: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 22:15:12 ait sshd[2482834]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 22:15:12 ait sshd[2482834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
description:
2025-01-26 22:16:11 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:38300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.37
description:
Jan 26 22:15:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.191.5
description:
Jan 26 22:16:35 ait sshd[2483544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.191.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 26 22:16:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.191.5
description:
Jan 26 22:16:35 ait sshd[2483544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.191.5


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.158.76.244
description:
Jan 26 22:16:48 ait sshd[2483692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.158.76.244  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 22:15:56 ait sshd[2483364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.37
description:
2025-01-26 22:15:58 dovecot_login authenticator failed for ([104.241.233.37]) [104.241.233.37]:43916: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 22:15:56 ait sshd[2483364]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-26 22:17:35 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:51490: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 26 22:17:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-26 22:17:27 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:54810: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-01-26 22:17:28 dovecot_login authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:41568: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 26 22:17:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
description:
Jan 26 22:17:45 ait sshd[2484215]: Failed password for invalid user debian from 195.178.191.5 port 50572 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-26 22:17:42 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:15700: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.191.5
description:
Jan 26 22:17:44 ait sshd[2484215]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.191.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.191.5
description:
Jan 26 22:17:44 ait sshd[2484215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.191.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 26 22:17:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.66.166
description:
[2025-01-26 22:17:26 +0100] info [webmaild] 170.82.66.166 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Jan 26 22:17:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.222.244.89
description:
Jan 26 22:17:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.222.244.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.222.244.89
description:
2025-01-26 22:17:40 dovecot_login authenticator failed for (89.244.222.60.adsl-pool.sx.cn) [60.222.244.89]:35243: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 26 22:17:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-26 22:17:53 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:37318: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.33.202.41
description:
Jan 26 22:18:30 ait sshd[2484435]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.33.202.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 26 22:18:46 ait sshd[2484582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
description:
Jan 26 22:18:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
description:
2025-01-26 22:18:09 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:51955: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
description:
2025-01-26 22:18:16 dovecot_plain authenticator failed for (luchod) [37.139.110.118]:60292: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.33.202.41
description:
Jan 26 22:18:30 ait sshd[2484435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.33.202.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 26 22:17:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
description:
Jan 26 22:18:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 150.253.33.15
description:
[2025-01-26 22:18:36 +0100] info [webmaild] 150.253.33.15 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 26 22:18:46 ait sshd[2484582]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.207.213
description:
Jan 26 22:17:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.207.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.213
description:
2025-01-26 22:17:58 dovecot_login authenticator failed for (197-255-207-213.netpagedns.net) [197.255.207.213]:59398: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.26.138.142
description:
[2025-01-26 22:18:53 +0100] info [webmaild] 95.26.138.142 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-01-26 22:17:57 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:32838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.39.132
description:
[2025-01-26 22:19:16 +0100] info [webmaild] 167.250.39.132 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.67.59.65
description:
Jan 26 22:19:51 ait sshd[2484897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.67.59.65


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.67.59.65
description:
Jan 26 22:19:51 ait sshd[2484897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.67.59.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 22:20:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 26 22:20:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.124.66
description:
47.128.124.66 - - [26/Jan/2025:22:20:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936459 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=517" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.124.66


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.67.59.65
description:
Jan 26 22:19:55 ait sshd[2484897]: Disconnected from invalid user test1 96.67.59.65 port 57262 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 22:20:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.33.202.41
description:
Jan 26 22:20:15 ait sshd[2485190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.33.202.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-26 22:20:36 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:54816: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.33.202.41
description:
Jan 26 22:20:15 ait sshd[2485190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.33.202.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.97.25.228
description:
[2025-01-26 22:20:48 +0100] info [webmaild] 102.97.25.228 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 22:20:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.52.42.46
description:
[2025-01-26 22:21:40 +0100] info [webmaild] 176.52.42.46 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.131.211.213
description:
[2025-01-26 22:21:15 +0100] info [webmaild] 190.131.211.213 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-26 22:21:21 dovecot_plain authenticator failed for 9498.telnet.bg (spent) [87.254.165.100]:59396: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
description:
2025-01-26 22:21:49 dovecot_plain authenticator failed for (dignacke) [65.20.250.63]:59849: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.33.202.41
description:
Jan 26 22:21:53 ait sshd[2486484]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.33.202.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.33.202.41
description:
Jan 26 22:21:53 ait sshd[2486484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.33.202.41


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.33.202.41
description:
Jan 26 22:21:55 ait sshd[2486484]: Failed password for invalid user user from 212.33.202.41 port 34538 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.67.59.65
description:
Jan 26 22:22:13 ait sshd[2486637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.67.59.65


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.67.59.65
description:
Jan 26 22:22:13 ait sshd[2486637]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.67.59.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.140
description:
47.128.96.140 - - [26/Jan/2025:22:21:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=31661617 HTTP/1.1" 302 0 aitopen.us "http://aitopen.us/?C=N%3BO=A" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.140


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-22.65.0.27.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 22:23:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 164.68.105.226
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:22-23.164.68.105.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-01-26 22:24:24 dovecot_login authenticator failed for ([218.67.123.202]) [218.67.123.202]:59001: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.67
description:
Jan 26 22:24:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.67
description:
2025-01-26 22:24:10 dovecot_login authenticator failed for ([181.233.93.3]) [181.233.93.67]:54112: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
description:
Jan 26 22:24:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.35.10
description:
[2025-01-26 22:24:29 +0100] info [webmaild] 37.239.35.10 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-26 22:24:34 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:50389: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.33.197
description:
2025-01-26 22:25:21 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.33.197]:54890: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.42.132.19
description:
2025-01-26 22:25:52 dovecot_login authenticator failed for ([111.42.132.19]) [111.42.132.19]:36386: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
description:
Jan 26 22:25:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
description:
2025-01-26 22:25:34 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:40432: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.132.19
description:
Jan 26 22:25:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.42.132.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 22:26:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-26 22:26:03 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (crialletty) [92.244.126.105]:58828: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 26 22:26:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-26 22:26:05 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:55830: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.151.200.0
description:
Jan 26 22:27:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.151.200.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.151.200.0
description:
2025-01-26 22:27:12 dovecot_plain authenticator failed for (aiontis) [89.151.200.0]:47485: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 22:27:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.212
description:
Jan 26 22:27:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.212
description:
2025-01-26 22:27:06 dovecot_login authenticator failed for ([195.178.110.212]) [195.178.110.212]:50217: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 22:28:09 ait sshd[2489423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 26 22:28:05 ait sshd[2489411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 22:28:09 ait sshd[2489423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.95.231.42
description:
[2025-01-26 22:29:26 +0100] info [webmaild] 177.95.231.42 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 26 22:31:25 ait sshd[2490665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 26 22:31:25 ait sshd[2490665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 22:33:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.214
description:
Jan 26 22:33:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-26 22:33:35 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:65521: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.19.126.22
description:
[2025-01-26 22:33:37 +0100] info [webmaild] 195.19.126.22 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.183.192.37
description:
[2025-01-26 22:33:05 +0100] info [webmaild] 38.183.192.37 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 26 22:35:18 ait sshd[2492552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 26 22:35:18 ait sshd[2492552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
description:
Jan 26 22:35:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
description:
2025-01-26 22:35:39 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:14582: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 26 22:36:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-26 22:36:07 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:33935: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 22:36:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 26 22:37:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-26 22:37:53 dovecot_plain authenticator failed for (henegrets) [185.65.238.250]:46777: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-26 22:37:54 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (anymmoce) [81.237.110.29]:52742: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.198.201
description:
[2025-01-26 22:37:04 +0100] info [webmaild] 37.237.198.201 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 26 22:37:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-01-26 22:38:40 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:50432: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.193.102.159
description:
2025-01-26 22:38:49 dovecot_login authenticator failed for ([104.193.102.159]) [104.193.102.159]:50291: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 26 22:38:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
description:
2025-01-26 22:38:08 dovecot_login authenticator failed for ([113.193.53.56]) [113.193.53.56]:33950: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.217
description:
Jan 26 22:38:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.217
description:
2025-01-26 22:38:11 dovecot_login authenticator failed for ([195.178.110.217]) [195.178.110.217]:61102: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Jan 26 22:38:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
description:
Jan 26 22:38:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 22:38:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.33.2.165
description:
Jan 26 22:39:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.33.2.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
description:
2025-01-26 22:38:56 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:56433: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.111
description:
[2025-01-26 22:40:44 +0100] info [whostmgrd] 104.207.48.111 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.179
description:
[2025-01-26 22:40:48 +0100] info [whostmgrd] 156.228.118.179 - ENG20B00207Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.15
description:
[2025-01-26 22:40:50 +0100] info [whostmgrd] 156.228.124.15 - ENG20B00207Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.2.165
description:
2025-01-26 22:39:56 dovecot_plain authenticator failed for (ocaeta) [41.33.2.165]:55330: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.174
description:
[2025-01-26 22:40:41 +0100] info [cpaneld] 156.228.104.174 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.178
description:
[2025-01-26 22:40:43 +0100] info [whostmgrd] 156.228.84.178 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.76.56.114
description:
Jan 26 22:40:22 ait sshd[2495640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.76.56.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.76.56.114
description:
Jan 26 22:40:22 ait sshd[2495640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.76.56.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.52
description:
[2025-01-26 22:40:41 +0100] info [cpaneld] 104.207.57.52 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.135
description:
[2025-01-26 22:40:42 +0100] info [cpaneld] 104.207.55.135 - ENG20B00207Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ENG20B00207Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.150
description:
[2025-01-26 22:40:46 +0100] info [whostmgrd] 156.228.125.150 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.106
description:
[2025-01-26 22:40:40 +0100] info [cpaneld] 156.228.95.106 - ENG20B00207Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ENG20B00207Y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 22:40:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.209
description:
[2025-01-26 22:40:42 +0100] info [cpaneld] 104.207.59.209 - ENG20B00207Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ENG20B00207Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.189
description:
[2025-01-26 22:40:44 +0100] info [whostmgrd] 156.228.96.189 - ENG20B00207Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.209
description:
2025-01-26 22:41:36 dovecot_login authenticator failed for ([195.178.110.209]) [195.178.110.209]:57253: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.202.200.90
description:
[2025-01-26 22:40:56 +0100] info [webmaild] 177.202.200.90 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 22:41:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.133
description:
Jan 26 22:41:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.133
description:
2025-01-26 22:41:18 dovecot_plain authenticator failed for (chros) [65.20.193.133]:40069: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 26 22:41:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-26 22:41:27 dovecot_plain authenticator failed for (uranonic) [185.65.238.250]:60391: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.209
description:
Jan 26 22:41:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 22:42:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.233
description:
Jan 26 22:42:37 ait sshd[2497440]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.233
description:
Jan 26 22:42:37 ait sshd[2497440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.233


plugin: modsec
rule: 77350366
name: IM360 WAF: Stored XSS In LiteSpeed Cache < 5.7.0.1 WordPress Plugin (CVE-2023-40000)
abuser: 179.43.191.19
domain: gou.university
description:
IM360 WAF: Stored XSS In LiteSpeed Cache < 5.7.0.1 WordPress Plugin (CVE-2023-40000)||MV:<script src=https://wplicense.org/admin-bar-reloaded.min.js></script>||MVN:ARGS:result[_msg]||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 60.50.169.222
description:
Jan 26 22:42:58 ait sshd[2497789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.50.169.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 26 22:43:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-26 22:43:20 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (vista) [92.244.126.105]:54176: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.30
description:
Jan 26 22:43:34 ait sshd[2498516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.30
description:
Jan 26 22:43:34 ait sshd[2498516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.30


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.50.169.222
description:
Jan 26 22:42:58 ait sshd[2497789]: pam_imunify(sshd:auth): [IM360_RBL] The IP 60.50.169.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.206
description:
[2025-01-26 22:44:02 +0100] info [cpaneld] 156.228.84.206 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.49
description:
[2025-01-26 22:44:06 +0100] info [whostmgrd] 156.228.105.49 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.65.13
description:
[2025-01-26 22:44:24 +0100] info [webmaild] 37.238.65.13 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.119
description:
[2025-01-26 22:44:01 +0100] info [cpaneld] 104.207.63.119 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.186
description:
[2025-01-26 22:44:07 +0100] info [whostmgrd] 104.207.63.186 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.208
description:
[2025-01-26 22:44:08 +0100] info [whostmgrd] 156.228.91.208 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 26 22:44:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-26 22:44:30 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (inchakle) [54.38.80.107]:58026: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.172
description:
[2025-01-26 22:44:03 +0100] info [cpaneld] 104.207.58.172 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.171
description:
[2025-01-26 22:44:03 +0100] info [cpaneld] 104.207.59.171 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.54
description:
[2025-01-26 22:44:04 +0100] info [whostmgrd] 104.207.56.54 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.76.56.114
description:
Jan 26 22:44:21 ait sshd[2499505]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.76.56.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.76.56.114
description:
Jan 26 22:44:21 ait sshd[2499505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.76.56.114  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:22-44.57.128.47.31


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 60.50.169.222
description:
Jan 26 22:44:53 ait sshd[2500014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.50.169.222


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.11
description:
[2025-01-26 22:44:03 +0100] info [cpaneld] 156.228.99.11 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.127
description:
[2025-01-26 22:44:05 +0100] info [whostmgrd] 156.228.125.127 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.156
description:
[2025-01-26 22:44:07 +0100] info [whostmgrd] 156.228.83.156 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.50.169.222
description:
Jan 26 22:44:53 ait sshd[2500014]: pam_imunify(sshd:auth): [IM360_RBL] The IP 60.50.169.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.89.93
description:
[2025-01-26 22:45:34 +0100] info [webmaild] 191.243.89.93 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.69.5.25
description:
[2025-01-26 22:45:36 +0100] info [webmaild] 105.69.5.25 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.96.110.236
description:
[2025-01-26 22:45:40 +0100] info [webmaild] 186.96.110.236 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.76.56.114
description:
Jan 26 22:45:49 ait sshd[2501463]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.76.56.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.76.56.114
description:
Jan 26 22:45:49 ait sshd[2501463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.76.56.114


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 60.50.169.222
description:
Jan 26 22:44:56 ait sshd[2500014]: Disconnected from invalid user office 60.50.169.222 port 38551 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.110.194
description:
Jan 26 22:45:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.110.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.110.194
description:
2025-01-26 22:45:02 dovecot_plain authenticator failed for (eltess) [78.186.110.194]:40276: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-01-26 22:46:29 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:49972: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.88.127.249
description:
Jan 26 22:46:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.88.127.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.50.169.222
description:
Jan 26 22:46:20 ait sshd[2502317]: pam_imunify(sshd:auth): [IM360_RBL] The IP 60.50.169.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.80.0.148
description:
[2025-01-26 22:46:21 +0100] info [webmaild] 201.80.0.148 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 60.50.169.222
description:
Jan 26 22:46:22 ait sshd[2502317]: Failed password for invalid user anti from 60.50.169.222 port 51890 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Jan 26 22:46:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 60.50.169.222
description:
Jan 26 22:46:20 ait sshd[2502317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.50.169.222


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.88.127.249
description:
2025-01-26 22:46:42 dovecot_login authenticator failed for ([220.88.127.249]) [220.88.127.249]:65036: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 26 22:47:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.76.202.22
description:
Jan 26 22:47:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.76.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Jan 26 22:47:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.110
description:
2025-01-26 22:47:27 dovecot_plain authenticator failed for (bructidey) [65.20.251.110]:59697: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 26 22:47:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-26 22:47:38 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:48478: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-26 22:47:40 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:45849: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.235.107.167
description:
[2025-01-26 22:47:53 +0100] info [webmaild] 88.235.107.167 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.202.22
description:
2025-01-26 22:47:24 dovecot_login authenticator failed for ([218.76.202.22]) [218.76.202.22]:60693: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.110
description:
Jan 26 22:47:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-01-26 22:47:27 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:42736: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.83.218
description:
[2025-01-26 22:48:31 +0100] info [webmaild] 37.236.83.218 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 66.63.187.168
domain: 136.243.145.84
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.114.122.224
description:
Jan 26 22:48:07 ait sshd[2503821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.114.122.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.114.122.224
description:
Jan 26 22:48:07 ait sshd[2503821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.114.122.224


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 26 22:49:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-26 22:49:12 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:60298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 26 22:49:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.40.16.26
description:
2025-01-26 22:49:46 dovecot_login authenticator failed for net-2-40-16-26.cust.vodafonedsl.it [2.40.16.26]:34012: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.222.244.89
description:
2025-01-26 22:49:52 dovecot_login authenticator failed for (89.244.222.60.adsl-pool.sx.cn) [60.222.244.89]:34428: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.239.186
description:
2025-01-26 22:49:15 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:59562: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 26 22:49:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Jan 26 22:49:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-26 22:49:52 dovecot_login authenticator failed for ([112.123.199.111]) [112.132.14.159]:50886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 22:49:10 ait sshd[2504290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-26 22:49:30 dovecot_login authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:49142: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 26 22:49:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-26 22:49:29 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:39888: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-26 22:49:41 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:50335: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
description:
2025-01-26 22:49:50 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:61204: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.219
description:
Jan 26 22:49:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 26 22:49:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 26 22:49:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Jan 26 22:49:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 26 22:48:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-26 22:49:00 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:50604: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-26 22:49:04 dovecot_plain authenticator failed for (indic) [89.23.210.188]:43166: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.239.186
description:
Jan 26 22:49:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.239.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 26 22:49:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-01-26 22:49:45 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:34552: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
description:
Jan 26 22:49:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
description:
2025-01-26 22:49:48 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:46573: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 22:49:10 ait sshd[2504290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-26 22:49:21 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:48690: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.40.16.26
description:
Jan 26 22:49:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.40.16.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
description:
Jan 26 22:49:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.222.244.89
description:
Jan 26 22:49:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.222.244.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.63.14
description:
Jan 26 22:49:58 ait sshd[2504643]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.129.63.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.129.63.14
description:
Jan 26 22:49:58 ait sshd[2504643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.129.63.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-26 22:50:01 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:41490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.117.62.41
description:
2025-01-26 22:50:32 dovecot_login authenticator failed for ([180.117.62.41]) [180.117.62.41]:38259: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
description:
Jan 26 22:50:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
description:
2025-01-26 22:50:47 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:56802: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.219
description:
2025-01-26 22:49:58 dovecot_login authenticator failed for ([60.31.181.219]) [60.31.181.219]:36150: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 26 22:50:09 ait sshd[2504823]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.117.62.41
description:
Jan 26 22:50:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.117.62.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-26 22:50:02 dovecot_login authenticator failed for s2.legionusa.com [159.203.87.228]:44828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
description:
2025-01-26 22:50:07 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:56671: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-26 22:50:11 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:41630: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 26 22:49:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 26 22:50:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 26 22:50:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 26 22:50:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 26 22:50:09 ait sshd[2504823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 26 22:51:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-26 22:51:10 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:37888: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-26 22:51:18 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:60388: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Jan 26 22:51:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.2.14
description:
2025-01-26 22:51:34 dovecot_login authenticator failed for cm-staticip-85-152-2-14.telecable.es [85.152.2.14]:41084: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
description:
2025-01-26 22:51:06 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:44531: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-26 22:51:05 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:57632: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.66
description:
Jan 26 22:51:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 26 22:51:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 26 22:51:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 26 22:51:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 26 22:51:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 26 22:51:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-26 22:51:20 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:60326: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
description:
Jan 26 22:51:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.114.122.224
description:
Jan 26 22:51:03 ait sshd[2505266]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.114.122.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.66
description:
2025-01-26 22:51:13 dovecot_login authenticator failed for ([104.241.237.66]) [104.241.237.66]:34445: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
description:
2025-01-26 22:51:19 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:59644: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-26 22:51:23 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:47596: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-26 22:51:25 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:38400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.2.14
description:
Jan 26 22:51:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.2.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-26 22:51:35 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:55090: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 26 22:51:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 26 22:51:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-26 22:51:20 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:3452: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-01-26 22:51:31 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:55582: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-26 22:51:40 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:44313: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.114.122.224
description:
Jan 26 22:51:03 ait sshd[2505266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.114.122.224


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-26 22:51:20 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:44710: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Jan 26 22:51:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 26 22:51:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
description:
Jan 26 22:51:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
description:
2025-01-26 22:51:25 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:40152: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 26 22:51:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.124.37.45
description:
[2025-01-26 22:51:00 +0100] info [webmaild] 194.124.37.45 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.193
description:
Jan 26 22:51:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 22:51:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-01-26 22:52:28 dovecot_login authenticator failed for ([50.224.22.135]) [50.224.22.135]:34513: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.114.122.224
description:
Jan 26 22:52:52 ait sshd[2505825]: Failed password for invalid user admin from 181.114.122.224 port 60156 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
description:
Jan 26 22:52:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 26 22:52:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
description:
2025-01-26 22:52:14 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:37192: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.206
description:
Jan 26 22:52:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
description:
Jan 26 22:52:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.129.114
description:
2025-01-26 22:52:16 dovecot_login authenticator failed for ([14.48.129.114]) [14.48.129.114]:35992: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.114.122.224
description:
Jan 26 22:52:50 ait sshd[2505825]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.114.122.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.246.227
description:
Jan 26 22:52:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.246.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.246.227
description:
2025-01-26 22:52:16 dovecot_login authenticator failed for st6627.mas4401.y-tokyo.nttpc.ne.jp [160.248.246.227]:51542: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.26.98
description:
Jan 26 22:52:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.26.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-26 22:52:37 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:55795: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.193
description:
2025-01-26 22:52:00 dovecot_login authenticator failed for ([104.241.230.193]) [104.241.230.193]:39979: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.114.122.224
description:
Jan 26 22:52:50 ait sshd[2505825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.114.122.224


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-26 22:52:14 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:46095: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Jan 26 22:52:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.206
description:
2025-01-26 22:52:27 dovecot_login authenticator failed for ([111.61.176.206]) [111.61.176.206]:55494: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
description:
2025-01-26 22:52:28 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:63827: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 26 22:52:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
description:
2025-01-26 22:53:33 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:40292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.210.105.166
description:
Jan 26 22:53:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.210.105.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.63.14
description:
Jan 26 22:53:45 ait sshd[2506285]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.129.63.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-26 22:53:19 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:50156: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-01-26 22:53:23 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:60062: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 26 22:53:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
description:
Jan 26 22:53:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 26 22:53:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-26 22:53:27 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:53013: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.166
description:
2025-01-26 22:53:43 dovecot_login authenticator failed for 95-210-105-166.ip.skylogicnet.com [95.210.105.166]:44318: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.129.63.14
description:
Jan 26 22:53:45 ait sshd[2506285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.129.63.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 26 22:53:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 26 22:53:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-26 22:53:41 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:24619: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.233
description:
Jan 26 22:54:40 ait sshd[2506590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 26 22:54:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-26 22:54:05 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:32931: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 26 22:54:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-26 22:54:19 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:43070: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.233
description:
Jan 26 22:54:40 ait sshd[2506590]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.233 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.34.113
description:
[2025-01-26 22:55:51 +0100] info [webmaild] 45.6.34.113 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.129.63.14
description:
Jan 26 22:55:07 ait sshd[2507015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.129.63.14


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.30
description:
Jan 26 22:55:30 ait sshd[2507235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.30


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-26 22:55:50 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:50314: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.63.14
description:
Jan 26 22:55:07 ait sshd[2507015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.129.63.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.30
description:
Jan 26 22:55:30 ait sshd[2507235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 26 22:55:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-26 22:56:04 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:60830: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.141.101.237
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:22-56.94.141.101.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 26 22:56:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 26 22:56:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-26 22:56:28 dovecot_plain authenticator failed for (overethin) [109.108.95.66]:52981: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.233
description:
Jan 26 22:56:56 ait sshd[2507739]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.233
description:
Jan 26 22:56:56 ait sshd[2507739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 22:57:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.127.30
description:
Jan 26 22:57:46 ait sshd[2508024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.127.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.127.30
description:
Jan 26 22:57:46 ait sshd[2508024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.127.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.162.142
description:
Jan 26 22:57:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.162.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.162.142
description:
2025-01-26 22:57:58 dovecot_plain authenticator failed for 142.162.246.94.ip4.artcom.pl (unithisma) [94.246.162.142]:47980: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.238.40.3
description:
[2025-01-26 22:58:03 +0100] info [webmaild] 88.238.40.3 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 22:58:05 ait sshd[2508146]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 22:58:05 ait sshd[2508146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 22:59:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.132
description:
Jan 26 22:59:00 ait sshd[2508571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.234.170
description:
[2025-01-26 22:59:09 +0100] info [webmaild] 177.84.234.170 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-26 23:00:50 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:59724: 535 Incorrect authentication data (set_id=prueba)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.69.224.129
description:
[2025-01-26 23:00:37 +0100] info [webmaild] 105.69.224.129 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 26 23:00:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
description:
2025-01-26 23:01:47 dovecot_login authenticator failed for ([151.3.178.94]) [151.3.178.94]:55314: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 26 23:01:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-26 23:01:33 dovecot_login authenticator failed for ([41.93.113.138]) [41.93.113.138]:56568: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.42.138
description:
[2025-01-26 23:01:37 +0100] info [webmaild] 91.106.42.138 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.178.94
description:
Jan 26 23:01:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.178.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 26 23:02:26 ait sshd[2509837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Jan 26 23:02:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-01-26 23:02:31 dovecot_login authenticator failed for ([60.173.114.254]) [60.173.114.254]:41571: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 79.137.203.224
domain: lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-02.79.137.203.224||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-26 23:02:45 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:43560: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 26 23:02:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
description:
2025-01-26 23:03:55 dovecot_login authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:58410: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-26 23:03:30 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:56290: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.71
description:
2025-01-26 23:03:31 dovecot_login authenticator failed for ([104.241.228.71]) [104.241.228.71]:52900: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-26 23:03:33 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (cophoen) [83.233.242.245]:40242: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 26 23:03:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-26 23:03:40 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:33697: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 23:03:46 ait sshd[2510477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.177.139.7
description:
[2025-01-26 23:03:04 +0100] info [webmaild] 160.177.139.7 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 26 23:03:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.71
description:
Jan 26 23:03:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 26 23:03:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
description:
Jan 26 23:03:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.226.68.250
description:
2025-01-26 23:04:23 dovecot_login authenticator failed for syn-072-226-068-250.res.spectrum.com [72.226.68.250]:60728: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 26 23:04:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-26 23:04:49 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:50658: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
description:
Jan 26 23:04:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-26 23:04:21 dovecot_login authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:58239: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-26 23:04:22 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:48222: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.61.8.150
description:
Jan 26 23:04:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.61.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.235.119
description:
Jan 26 23:04:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.235.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
description:
Jan 26 23:04:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 26 23:04:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.226.68.250
description:
Jan 26 23:04:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.226.68.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.95
description:
Jan 26 23:04:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
description:
2025-01-26 23:04:28 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:20420: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-26 23:04:12 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:46270: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
description:
2025-01-26 23:04:13 dovecot_login authenticator failed for ([60.172.230.184]) [60.172.230.184]:57346: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 26 23:04:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.8.150
description:
2025-01-26 23:04:25 dovecot_login authenticator failed for ([190.61.8.150]) [190.61.8.150]:48413: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.119
description:
2025-01-26 23:04:35 dovecot_login authenticator failed for ([104.241.235.119]) [104.241.235.119]:46688: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-26 23:04:12 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:34586: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Jan 26 23:04:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 26 23:04:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.202.15.69
description:
Jan 26 23:04:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.202.15.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Jan 26 23:04:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.95
description:
2025-01-26 23:04:23 dovecot_login authenticator failed for ([104.241.231.95]) [104.241.231.95]:45103: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
description:
Jan 26 23:04:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
description:
2025-01-26 23:04:26 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:51987: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-01-26 23:04:32 dovecot_login authenticator failed for ([38.49.182.103]) [38.49.182.103]:32770: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-01-26 23:04:36 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:36250: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.132
description:
Jan 26 23:05:02 ait sshd[2510968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.132


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.210.105.166
description:
Jan 26 23:05:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.210.105.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.151.183.176
description:
Jan 26 23:05:37 ait sshd[2511399]: pam_imunify(sshd:auth): [IM360_RBL] The IP 219.151.183.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 219.151.183.176
description:
Jan 26 23:05:37 ait sshd[2511399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.151.183.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.166
description:
2025-01-26 23:05:11 dovecot_login authenticator failed for 95-210-105-166.ip.skylogicnet.com [95.210.105.166]:35414: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-26 23:05:19 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:42868: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 26 23:05:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 26 23:05:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-26 23:05:31 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:43168: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.11.10
description:
Jan 26 23:05:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.11.10
description:
2025-01-26 23:05:35 dovecot_login authenticator failed for ([112.78.11.10]) [112.78.11.10]:58300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 26 23:06:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 26 23:06:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
description:
2025-01-26 23:06:19 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:32106: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Jan 26 23:06:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.52.221
description:
Jan 26 23:06:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.52.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.133.2
description:
Jan 26 23:06:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.133.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
description:
2025-01-26 23:06:03 dovecot_login authenticator failed for syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:64279: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-26 23:06:21 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:46218: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-26 23:06:34 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:49236: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
description:
Jan 26 23:06:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-26 23:06:20 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:45308: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Jan 26 23:06:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-26 23:06:35 dovecot_login authenticator failed for ([116.113.254.26]) [116.113.254.26]:47760: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.52.221
description:
2025-01-26 23:06:40 dovecot_plain authenticator failed for c188-150-52-221.bredband.tele2.se (ratic) [188.150.52.221]:51498: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-26 23:07:46 dovecot_login authenticator failed for ([183.196.174.235]) [183.196.174.235]:25766: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.6.10.222
description:
Jan 26 23:07:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.6.10.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.225.178
description:
[2025-01-26 23:07:40 +0100] info [webmaild] 181.191.225.178 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 26 23:07:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 26 23:07:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 23:08:46 ait sshd[2512724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-26 23:08:54 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:45028: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.6.10.222
description:
Jan 26 23:07:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.6.10.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 26 23:08:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-08.65.0.27.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-01-26 23:08:37 dovecot_login authenticator failed for ([112.27.129.78]) [112.27.129.78]:44467: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 26 23:08:06 ait sshd[2512260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-26 23:08:34 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:46902: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
description:
Jan 26 23:08:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 26 23:08:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Jan 26 23:08:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 23:08:46 ait sshd[2512724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-26 23:08:08 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:52604: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.172
description:
Jan 26 23:08:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.172
description:
2025-01-26 23:08:04 dovecot_login authenticator failed for ([104.241.237.172]) [104.241.237.172]:48102: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 26 23:08:06 ait sshd[2512260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 23:09:10 ait sshd[2512819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 26 23:09:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-26 23:09:37 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:59964: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 26 23:09:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-26 23:09:30 dovecot_plain authenticator failed for (untban) [178.250.191.189]:59868: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 26 23:09:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-26 23:09:51 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:43418: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.171.26
description:
Jan 26 23:08:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.171.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.171.26
description:
2025-01-26 23:09:00 dovecot_plain authenticator failed for lmontsouris-656-1-112-26.w193-252.abo.wanadoo.fr (jimble) [193.252.171.26]:59025: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
description:
Jan 26 23:09:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-01-26 23:09:28 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:55280: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 26 23:08:58 ait sshd[2512771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 23:09:10 ait sshd[2512819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Jan 26 23:09:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-26 23:09:38 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:50628: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-01-26 23:09:22 dovecot_plain authenticator failed for (flopt) [64.72.74.162]:41351: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-26 23:09:26 dovecot_plain authenticator failed for ([82.193.122.91]) [82.193.122.91]:46821: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 26 23:08:58 ait sshd[2512771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 26 23:09:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Jan 26 23:09:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 23:09:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
description:
2025-01-26 23:09:20 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:38058: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 26 23:09:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.211.157.55
description:
[2025-01-26 23:10:06 +0100] info [webmaild] 186.211.157.55 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Jan 26 23:10:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-26 23:10:16 dovecot_login authenticator failed for ([116.113.254.26]) [116.113.254.26]:53688: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 23:10:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 26 23:10:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-26 23:10:30 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:36198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.132
description:
Jan 26 23:11:04 ait sshd[2513601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.127.151
description:
[2025-01-26 23:11:12 +0100] info [webmaild] 170.0.127.151 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.66.222
description:
2025-01-26 23:11:50 dovecot_login authenticator failed for ([94.204.66.222]) [94.204.66.222]:34122: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.132
description:
Jan 26 23:11:04 ait sshd[2513601]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.66.222
description:
Jan 26 23:11:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.241.149.70
description:
[2025-01-26 23:12:03 +0100] info [webmaild] 87.241.149.70 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 26 23:12:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.214.101
description:
[2025-01-26 23:12:39 +0100] info [webmaild] 45.234.214.101 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.52.229.40
description:
2025-01-26 23:12:22 dovecot_login authenticator failed for node-199k.pool-182-52.dynamic.totinternet.net [182.52.229.40]:41225: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-26 23:12:30 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:47168: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-26 23:12:36 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.138]:45846: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-26 23:12:16 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:39152: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.52.229.40
description:
Jan 26 23:12:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.52.229.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 26 23:12:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Jan 26 23:11:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-01-26 23:12:01 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:35554: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 23:12:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Jan 26 23:12:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.29.101
description:
Jan 26 23:13:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.29.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.29.101
description:
2025-01-26 23:13:02 dovecot_login authenticator failed for (doserver.womenpla.net) [139.59.29.101]:56496: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 26 23:13:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.116.86
description:
[2025-01-26 23:12:58 +0100] info [webmaild] 170.246.116.86 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-26 23:13:04 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:62972: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-26 23:13:13 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:52914: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 26 23:13:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 26 23:13:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-26 23:13:22 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:46865: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.110.20
description:
47.128.110.20 - - [26/Jan/2025:23:13:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17831964 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/967841?panel=db" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 26 23:14:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-26 23:14:32 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:36285: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
description:
Jan 26 23:14:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
description:
2025-01-26 23:14:48 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:33288: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 26 23:14:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 26 23:14:08 ait sshd[2514688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-26 23:14:20 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:34376: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 26 23:14:08 ait sshd[2514688]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 26 23:14:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.17.135.22
description:
[2025-01-26 23:14:28 +0100] info [webmaild] 185.17.135.22 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.64.20
description:
Jan 26 23:14:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.64.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-26 23:14:58 dovecot_login authenticator failed for ([211.107.21.221]) [121.168.116.150]:49592: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 26 23:15:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.71
description:
Jan 26 23:15:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 26 23:15:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.219.154
description:
[2025-01-26 23:15:09 +0100] info [webmaild] 45.161.219.154 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.80.201
description:
2025-01-26 23:15:11 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:31082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.114.101
description:
Jan 26 23:15:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.114.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
description:
2025-01-26 23:15:52 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:60214: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.109.1.49
description:
2025-01-26 23:15:55 dovecot_login authenticator failed for ([182.109.1.49]) [182.109.1.49]:54337: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.114.101
description:
2025-01-26 23:15:40 dovecot_plain authenticator failed for ([119.160.114.101]) [119.160.114.101]:57208: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.71
description:
2025-01-26 23:15:40 dovecot_login authenticator failed for ([104.241.237.71]) [104.241.237.71]:52627: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.78
description:
Jan 26 23:15:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 26 23:15:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.109.1.49
description:
Jan 26 23:15:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.109.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.64.20
description:
2025-01-26 23:14:59 dovecot_plain authenticator failed for ([94.207.64.20]) [94.207.64.20]:48576: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-26 23:15:49 dovecot_plain authenticator failed for ([170.250.152.88]) [170.250.152.88]:46974: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-26 23:15:54 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:37935: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-26 23:16:06 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:43852: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 26 23:16:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-26 23:16:33 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:45836: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.243.187
description:
Jan 26 23:16:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.243.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.0.61.49
description:
2025-01-26 23:16:49 dovecot_login authenticator failed for ([27.0.61.49]) [27.0.61.49]:41142: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 26 23:16:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.0.61.49
description:
Jan 26 23:16:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.0.61.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-26 23:16:54 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:39902: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-26 23:16:09 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:59858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 26 23:16:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 26 23:16:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 26 23:16:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-01-26 23:16:41 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:46417: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-26 23:16:51 dovecot_login authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:35724: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 26 23:17:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-01-26 23:17:16 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:56474: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-01-26 23:17:36 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:46867: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-26 23:17:08 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:63159: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Jan 26 23:17:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.57.151.195
description:
[2025-01-26 23:17:34 +0100] info [webmaild] 190.57.151.195 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Jan 26 23:17:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.151.200.0
description:
Jan 26 23:18:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.151.200.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 26 23:18:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.147
description:
Jan 26 23:18:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Jan 26 23:18:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-01-26 23:18:50 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:58104: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.22.124
description:
Jan 26 23:18:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.22.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 23:18:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
description:
Jan 26 23:18:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.147
description:
2025-01-26 23:18:42 dovecot_login authenticator failed for (m121-202-198-147.smartone.com) [121.202.198.147]:54982: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.22.124
description:
2025-01-26 23:18:52 dovecot_login authenticator failed for ([94.207.22.124]) [94.207.22.124]:51894: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-26 23:19:29 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:36144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-01-26 23:19:47 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:42684: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.103.231.87
description:
Jan 26 23:19:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.103.231.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-01-26 23:19:06 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:42344: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-26 23:19:13 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:39512: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Jan 26 23:19:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.231.87
description:
2025-01-26 23:19:03 dovecot_login authenticator failed for ([119.155.143.226]) [59.103.231.87]:56917: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-26 23:19:36 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:57530: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-01-26 23:19:42 dovecot_login authenticator failed for ([196.28.226.123]) [196.28.226.123]:43978: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.148.10
description:
Jan 26 23:19:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.148.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
description:
2025-01-26 23:19:56 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:59998: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 26 23:19:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.151.200.0
description:
Jan 26 23:19:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.151.200.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
description:
Jan 26 23:19:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 26 23:19:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 26 23:19:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-26 23:19:25 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:64386: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 26 23:19:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
description:
Jan 26 23:19:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-26 23:18:58 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:55754: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.7.10
description:
Jan 26 23:20:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.7.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 23:20:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.115.87.186
description:
2025-01-26 23:20:07 dovecot_login authenticator failed for ([217.115.87.186]) [217.115.87.186]:61650: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 23:20:46 ait sshd[2517469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 23:20:46 ait sshd[2517469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-01-26 23:20:48 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:37696: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-01-26 23:20:54 dovecot_login authenticator failed for ([120.194.7.10]) [120.194.7.10]:60776: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.115.87.186
description:
Jan 26 23:20:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.115.87.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Jan 26 23:20:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
description:
Jan 26 23:21:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-26 23:21:22 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:39730: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.143
description:
Jan 26 23:21:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.143
description:
2025-01-26 23:21:31 dovecot_plain authenticator failed for ([122.187.227.143]) [122.187.227.143]:37174: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 26 23:21:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.70
description:
2025-01-26 23:21:39 dovecot_login authenticator failed for ([104.241.238.70]) [104.241.238.70]:54910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 26 23:21:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 26 23:21:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-26 23:21:22 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:61660: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.70
description:
Jan 26 23:21:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-26 23:21:42 dovecot_plain authenticator failed for ([60.213.27.250]) [60.213.27.250]:53765: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-01-26 23:21:42 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:5261: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-01-26 23:21:09 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:48728: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 26 23:21:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-26 23:21:18 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53345: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
description:
Jan 26 23:21:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Jan 26 23:22:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.124.18.229
description:
[2025-01-26 23:22:00 +0100] info [webmaild] 190.124.18.229 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 26 23:22:13 ait sshd[2517944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-01-26 23:22:27 dovecot_login authenticator failed for (m121-202-152-7.smartone.com) [121.202.152.7]:45342: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Jan 26 23:22:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-01-26 23:22:43 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:39690: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.138.169.233
description:
[2025-01-26 23:22:04 +0100] info [webmaild] 177.138.169.233 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 26 23:22:13 ait sshd[2517944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.50.125
description:
Jan 26 23:23:06 ait sshd[2518210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.50.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.124.145.199
description:
Jan 26 23:23:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.124.145.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.50.14
description:
2025-01-26 23:23:00 dovecot_plain authenticator failed for (201-91-49-72.customer.tdatabrasil.net.br) [187.92.50.14]:37577: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.50.125
description:
Jan 26 23:23:06 ait sshd[2518210]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.50.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 23:23:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.50.14
description:
Jan 26 23:22:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.50.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.124.145.199
description:
2025-01-26 23:23:14 dovecot_plain authenticator failed for ([64.124.145.199]) [64.124.145.199]:36027: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 79.137.203.224
domain: lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-24.79.137.203.224||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 23:24:45 ait sshd[2518770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
description:
Jan 26 23:24:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
description:
2025-01-26 23:24:02 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (ouctoking) [188.149.132.246]:52633: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.227.235
description:
2025-01-26 23:24:21 H=(mail.ait-ext.com) [165.154.227.235]:64073 F=<qnagsrona@ait-ext.com> rejected RCPT <validxxxg@gmail.com>: Rejected relay attempt: '165.154.227.235' From: 'qnagsrona@ait-ext.com' To: 'validxxxg@gmail.com'


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 23:24:45 ait sshd[2518770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Jan 26 23:25:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-01-26 23:25:03 dovecot_plain authenticator failed for (suroic) [64.72.74.162]:45521: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 26 23:25:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.217.243
description:
[2025-01-26 23:25:11 +0100] info [webmaild] 177.234.217.243 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 26 23:25:18 ait sshd[2519305]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-26 23:25:06 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:40474: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 26 23:25:18 ait sshd[2519303]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 26 23:25:18 ait sshd[2519303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 26 23:25:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 26 23:25:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 26 23:25:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-26 23:25:09 dovecot_plain authenticator failed for 9498.telnet.bg (prucepents) [87.254.165.100]:38400: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-26 23:25:21 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:3214: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-26 23:25:56 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:48028: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.63.214.213
description:
Jan 26 23:26:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.63.214.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
description:
2025-01-26 23:26:42 dovecot_login authenticator failed for ([58.63.214.213]) [58.63.214.213]:11995: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
description:
Jan 26 23:25:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.186.118.31
description:
Jan 26 23:26:09 ait sshd[2519686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.186.118.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-01-26 23:26:13 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:51273: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 23:26:34 ait sshd[2519803]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 26 23:26:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-26 23:26:27 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:33291: 535 Incorrect authentication data (set_id=iric@aitopen.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 23:26:34 ait sshd[2519803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
description:
2025-01-26 23:26:01 dovecot_login authenticator failed for ([1.180.97.138]) [1.180.97.138]:44587: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-26 23:26:01 dovecot_login authenticator failed for ([103.178.158.133]) [103.178.158.132]:49976: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
description:
2025-01-26 23:26:11 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:44676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
description:
Jan 26 23:26:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.170.135
description:
[2025-01-26 23:26:30 +0100] info [webmaild] 191.37.170.135 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 26 23:25:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.208
description:
Jan 26 23:26:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-01-26 23:26:11 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:39590: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 26 23:26:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 26 23:27:46 ait sshd[2520302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.186.118.31
description:
Jan 26 23:26:58 ait sshd[2519916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.186.118.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.145.233
description:
2025-01-26 23:27:38 dovecot_plain authenticator failed for ([110.49.145.233]) [110.49.145.233]:37912: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 26 23:27:46 ait sshd[2520302]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 23:27:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.49.145.233
description:
Jan 26 23:27:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.49.145.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 26 23:27:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 26 23:27:24 ait sshd[2520230]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-26 23:27:48 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:49124: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
description:
2025-01-26 23:27:06 dovecot_plain authenticator failed for ([187.12.112.186]) [187.12.112.186]:37004: 535 Incorrect authentication data


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 26 23:27:24 ait sshd[2520230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 26 23:28:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-26 23:28:13 dovecot_login authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:56616: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 26 23:28:34 ait sshd[2520583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 26 23:28:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.186.191
description:
2025-01-26 23:28:25 dovecot_login authenticator failed for m106153186191.v4.enabler.ne.jp [106.153.186.191]:33958: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 26 23:28:34 ait sshd[2520583]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-26 23:28:49 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:3486: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-26 23:28:49 dovecot_login authenticator failed for ([195.252.209.189]) [195.252.209.189]:45814: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 26 23:28:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 23:28:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.153.186.191
description:
Jan 26 23:28:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.153.186.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.255.14.177
description:
[2025-01-26 23:28:29 +0100] info [webmaild] 187.255.14.177 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-01-26 23:29:46 dovecot_plain authenticator failed for ([60.221.215.232]) [60.221.215.232]:58498: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.105.182.88
description:
2025-01-26 23:29:03 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:56666: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Jan 26 23:29:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
description:
Jan 26 23:29:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.148.71
description:
2025-01-26 23:29:44 dovecot_plain authenticator failed for broadband-95-84-148-71.ip.moscow.rt.ru [95.84.148.71]:56842: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-26 23:28:59 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:52755: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-26 23:29:12 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:55509: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.43.143
description:
Jan 26 23:29:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.113.43.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-26 23:29:01 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:4046: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.2.159.209
description:
[2025-01-26 23:29:07 +0100] info [webmaild] 201.2.159.209 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 26 23:29:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 26 23:29:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 26 23:29:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Jan 26 23:28:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 26 23:29:05 ait sshd[2520921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-26 23:29:35 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:54698: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 26 23:28:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-26 23:29:23 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:49724: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-01-26 23:29:28 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:43508: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Jan 26 23:29:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 26 23:29:05 ait sshd[2520921]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.148.71
description:
Jan 26 23:29:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.148.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
description:
2025-01-26 23:29:57 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:47026: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 23:30:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 26 23:30:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-26 23:30:42 dovecot_plain authenticator failed for (calloscum) [185.65.238.250]:49361: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 26 23:30:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-26 23:30:57 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:54056: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.62.3
description:
2025-01-26 23:31:43 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:54140: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-01-26 23:31:57 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:22534: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.62.3
description:
Jan 26 23:31:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.62.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Jan 26 23:31:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
description:
Jan 26 23:31:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
description:
2025-01-26 23:31:17 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:57184: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 142.132.255.108
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:23-31.142.132.255.108


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 26 23:32:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-26 23:32:48 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:23061: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Jan 26 23:32:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.199.27
description:
Jan 26 23:32:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.27.132
description:
Jan 26 23:32:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.27.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 23:32:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-01-26 23:32:57 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:43582: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-01-26 23:33:10 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:34174: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-01-26 23:33:45 dovecot_login authenticator failed for ([31.173.9.222]) [31.173.9.222]:53860: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Jan 26 23:33:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-01-26 23:33:00 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:42690: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 26 23:33:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
description:
Jan 26 23:33:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 26 23:32:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-26 23:33:34 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:54402: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
description:
Jan 26 23:35:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 23:35:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 26 23:35:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 23:35:27 ait sshd[2523983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
description:
2025-01-26 23:35:13 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:49986: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 26 23:35:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 26 23:35:26 ait sshd[2523980]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-26 23:35:49 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:37894: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.93
description:
Jan 26 23:35:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-26 23:35:23 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:33684: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 26 23:35:26 ait sshd[2523980]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-26 23:35:24 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:58381: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.170
description:
Jan 26 23:35:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.170
description:
2025-01-26 23:35:43 dovecot_login authenticator failed for ([104.241.233.170]) [104.241.233.170]:46530: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 26 23:35:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-01-26 23:35:41 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:58452: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 26 23:35:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-26 23:35:46 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:43764: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 23:35:27 ait sshd[2523983]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 26 23:36:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 23:36:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-26 23:36:02 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:60809: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-26 23:36:02 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:22888: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-26 23:36:38 dovecot_plain authenticator failed for ([116.231.84.13]) [116.231.84.13]:64174: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
description:
Jan 26 23:36:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 26 23:36:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 26 23:36:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-26 23:36:56 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:52624: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
description:
2025-01-26 23:36:50 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:46625: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 26 23:36:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 26 23:37:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-26 23:37:21 dovecot_login authenticator failed for ([218.22.187.66]) [218.22.187.66]:56694: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-26 23:37:37 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:36048: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-01-26 23:37:40 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:59896: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 26 23:37:14 ait sshd[2524701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 26 23:37:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-26 23:37:18 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:57264: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.124.246.75
description:
[2025-01-26 23:37:42 +0100] info [webmaild] 190.124.246.75 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.19.170.166
description:
2025-01-26 23:37:26 dovecot_login authenticator failed for ([202.188.165.198]) [210.19.170.166]:54320: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Jan 26 23:37:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-26 23:37:54 dovecot_login authenticator failed for ([112.123.199.111]) [112.132.14.159]:37124: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 26 23:37:14 ait sshd[2524701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.19.170.166
description:
Jan 26 23:37:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.19.170.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 26 23:37:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-26 23:37:37 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:59177: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Jan 26 23:37:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 26 23:37:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.213
description:
2025-01-26 23:38:53 dovecot_login authenticator failed for ([195.178.110.213]) [195.178.110.213]:62620: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.128.12
description:
[2025-01-26 23:38:32 +0100] info [webmaild] 45.165.128.12 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
description:
Jan 26 23:38:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-01-26 23:38:48 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:52919: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.213
description:
Jan 26 23:38:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-26 23:39:15 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:56462: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.119.180.238
description:
Jan 26 23:39:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.119.180.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.9.38.174
description:
Jan 26 23:39:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.9.38.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.44.52.104
description:
[2025-01-26 23:39:15 +0100] info [webmaild] 191.44.52.104 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 26 23:39:24 ait sshd[2525496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-26 23:39:31 dovecot_login authenticator failed for ([217.32.209.50]) [217.32.209.51]:38534: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.9.38.174
description:
2025-01-26 23:39:36 dovecot_login authenticator failed for ([76.9.38.174]) [76.9.38.174]:39948: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-01-26 23:39:47 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:56705: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 26 23:39:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.179
description:
2025-01-26 23:39:23 dovecot_login authenticator failed for ([104.241.233.179]) [104.241.233.179]:52895: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.119.180.238
description:
2025-01-26 23:39:28 dovecot_login authenticator failed for ([42.119.180.238]) [42.119.180.238]:40451: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 26 23:39:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-26 23:39:46 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:49913: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Jan 26 23:39:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
description:
2025-01-26 23:39:26 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:37177: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-26 23:39:50 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:4304: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 26 23:38:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.44.17.116
description:
[2025-01-26 23:39:36 +0100] info [webmaild] 38.44.17.116 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-26 23:39:40 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:61775: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.179
description:
Jan 26 23:39:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Jan 26 23:39:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-26 23:39:00 dovecot_plain authenticator failed for ([186.238.43.146]) [186.238.43.146]:48764: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-26 23:39:12 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:46412: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 26 23:39:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 26 23:39:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 26 23:39:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 26 23:39:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 23:40:09 ait sshd[2525966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 23:39:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 23:40:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:41646: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
description:
2025-01-26 23:40:01 dovecot_login authenticator failed for ([60.172.230.184]) [60.172.230.184]:44401: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-26 23:40:05 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:22371: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 23:40:09 ait sshd[2525966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-01-26 23:41:32 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:50276: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.189.29.55
description:
[2025-01-26 23:41:41 +0100] info [webmaild] 200.189.29.55 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.150.178
description:
Jan 26 23:41:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.150.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.150.178
description:
2025-01-26 23:41:54 dovecot_plain authenticator failed for ([178.46.150.178]) [178.46.150.178]:34688: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.34.64.189
description:
[2025-01-26 23:41:06 +0100] info [webmaild] 27.34.64.189 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.210
description:
Jan 26 23:41:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.210
description:
2025-01-26 23:41:26 dovecot_login authenticator failed for ([195.178.110.210]) [195.178.110.210]:56689: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-26 23:41:02 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:52494: 535 Incorrect authentication data (set_id=abs68a66678y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Jan 26 23:41:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 26 23:41:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-01-26 23:41:35 dovecot_login authenticator failed for (76-72-14-152.swr.dyn.lusfiber.net) [76.72.14.152]:64253: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Jan 26 23:41:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Jan 26 23:41:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-26 23:41:44 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:56942: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
description:
2025-01-26 23:42:05 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:37258: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.20
description:
Jan 26 23:42:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 26 23:42:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 26 23:42:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-01-26 23:41:59 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:55354: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
description:
Jan 26 23:42:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.20
description:
2025-01-26 23:42:28 dovecot_plain authenticator failed for ([188.59.178.20]) [188.59.178.20]:49601: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-26 23:42:38 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:46462: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.228.57.19
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-42.109.228.57.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Jan 26 23:41:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.91.73.253
description:
Jan 26 23:42:36 ait sshd[2526737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.91.73.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-26 23:42:53 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:46015: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.2
description:
2025-01-26 23:43:05 dovecot_plain authenticator failed for ([222.180.2.2]) [222.180.2.2]:56510: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.167
description:
Jan 26 23:43:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.167
description:
2025-01-26 23:43:22 dovecot_plain authenticator failed for 167.43.246.220.static.netvigator.com [220.246.43.167]:50479: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.63.179
description:
Jan 26 23:43:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.63.179 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 26 23:43:43 ait sshd[2527090]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-26 23:43:36 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:2335: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.45.132
description:
[2025-01-26 23:43:42 +0100] info [webmaild] 177.84.45.132 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.2
description:
Jan 26 23:43:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Jan 26 23:43:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-01-26 23:43:18 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:44828: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.63.179
description:
2025-01-26 23:43:31 dovecot_plain authenticator failed for ([183.234.63.179]) [183.234.63.179]:57868: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 26 23:43:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-01-26 23:44:42 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:5423: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.31.183
description:
47.128.31.183 - - [26/Jan/2025:23:44:44 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7264280 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=59" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.31.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 26 23:44:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-26 23:44:49 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:56970: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
description:
Jan 26 23:44:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
description:
2025-01-26 23:44:09 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:57370: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 23:44:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Jan 26 23:44:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Jan 26 23:45:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
description:
2025-01-26 23:45:20 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:42905: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.215.126.22
description:
2025-01-26 23:45:53 dovecot_plain authenticator failed for ([60.215.126.22]) [60.215.126.22]:49069: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Jan 26 23:45:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.161
description:
2025-01-26 23:45:01 dovecot_plain authenticator failed for (nlos-200-161.zamnet.zm) [196.46.200.161]:47571: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-01-26 23:45:16 dovecot_login authenticator failed for ([41.159.145.190]) [41.159.145.190]:45436: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
description:
Jan 26 23:45:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.227.238
description:
Jan 26 23:45:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.227.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.149.68
description:
[2025-01-26 23:45:54 +0100] info [webmaild] 201.17.149.68 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.161
description:
Jan 26 23:44:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.227.238
description:
2025-01-26 23:45:36 dovecot_login authenticator failed for ([221.163.227.238]) [221.163.227.238]:36797: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.215.126.22
description:
Jan 26 23:45:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.215.126.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.8.106
description:
Jan 26 23:45:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
description:
2025-01-26 23:45:36 dovecot_plain authenticator failed for ([58.16.8.106]) [58.16.8.106]:37658: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-01-26 23:45:56 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:34590: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Jan 26 23:46:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-01-26 23:46:51 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:50609: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.121.66.215
description:
Jan 26 23:46:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.121.66.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.121.66.215
description:
2025-01-26 23:46:06 dovecot_plain authenticator failed for ([220.121.66.215]) [220.121.66.215]:30137: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
description:
Jan 26 23:46:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
description:
2025-01-26 23:46:12 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:26710: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-26 23:47:32 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:50856: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-01-26 23:47:38 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:41495: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 23:47:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 23:47:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-01-26 23:47:12 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:51170: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 26 23:47:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
description:
2025-01-26 23:47:27 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:36112: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 26 23:47:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Jan 26 23:47:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Jan 26 23:47:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-26 23:47:15 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:54456: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
description:
Jan 26 23:47:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.113.86.201
description:
Jan 26 23:48:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.113.86.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.113.86.201
description:
2025-01-26 23:48:43 dovecot_plain authenticator failed for 88-113-86-201.elisa-laajakaista.fi (valembom) [88.113.86.201]:60924: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.106.37.60
description:
[2025-01-26 23:48:15 +0100] info [webmaild] 187.106.37.60 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 23:48:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
description:
Jan 26 23:49:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
description:
2025-01-26 23:49:56 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:53519: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.50.164.146
description:
Jan 26 23:50:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.50.164.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-01-26 23:50:29 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:55454: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-26 23:50:29 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:44240: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 26 23:50:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-26 23:50:07 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:49984: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 26 23:50:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.177.145.56
description:
[2025-01-26 23:50:49 +0100] info [webmaild] 201.177.145.56 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.50.164.146
description:
2025-01-26 23:50:19 dovecot_plain authenticator failed for static-173-50-164-146.pghkny.fios.verizon.net [173.50.164.146]:58797: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Jan 26 23:50:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 26 23:50:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-26 23:50:37 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:2355: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.134
description:
Jan 26 23:51:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.134
description:
2025-01-26 23:51:29 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:46660: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 26 23:51:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-26 23:51:44 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:50014: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-01-26 23:52:47 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:57488: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Jan 26 23:52:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-01-26 23:52:51 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:35551: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-26 23:52:32 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:52338: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.66
description:
2025-01-26 23:52:13 dovecot_login authenticator failed for ([92.118.39.66]) [92.118.39.66]:62564: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-01-26 23:52:39 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:59206: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.201.89.108
description:
[2025-01-26 23:52:43 +0100] info [webmaild] 41.201.89.108 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.66
description:
Jan 26 23:52:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.58
description:
Jan 26 23:52:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 26 23:52:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Jan 26 23:52:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.58
description:
2025-01-26 23:52:47 dovecot_login authenticator failed for ([104.241.229.58]) [104.241.229.58]:34273: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Jan 26 23:52:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.17.183
description:
47.128.17.183 - - [26/Jan/2025:23:52:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28554309 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning?page_id=viagra-generico-pre%C3%A7o-porto-alegre" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-26 23:53:50 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:59712: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-26 23:53:50 dovecot_plain authenticator failed for (solity) [62.231.31.86]:55298: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.205.244.221
description:
2025-01-26 23:53:53 dovecot_login authenticator failed for (191-205-244-221.user.vivozap.com.br) [191.205.244.221]:32592: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-26 23:53:33 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:54713: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-01-26 23:53:45 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:36338: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
description:
2025-01-26 23:53:12 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:47302: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 26 23:53:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-26 23:53:30 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:43183: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 26 23:53:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 26 23:53:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Jan 26 23:52:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-01-26 23:53:01 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:52266: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
description:
Jan 26 23:53:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Jan 26 23:53:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.205.244.221
description:
Jan 26 23:53:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.205.244.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 26 23:53:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 26 23:54:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-26 23:54:54 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:19950: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-26 23:54:18 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:40678: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.14.107
description:
[2025-01-26 23:54:29 +0100] info [webmaild] 186.237.14.107 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-26 23:54:53 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:46618: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-26 23:54:01 dovecot_login authenticator failed for (170.250.152.88.hwccustomers.com) [170.250.152.88]:49422: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.210.176
description:
2025-01-26 23:54:33 dovecot_login authenticator failed for ([183.107.210.176]) [183.107.210.176]:44548: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
description:
2025-01-26 23:54:35 dovecot_login authenticator failed for ([103.190.91.20]) [103.190.91.20]:43668: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 26 23:54:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
description:
2025-01-26 23:54:39 dovecot_login authenticator failed for (17.54.gonzagatelecom.com.br) [177.128.54.17]:60474: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
description:
Jan 26 23:54:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 26 23:54:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 26 23:54:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-26 23:54:12 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:48414: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.210.176
description:
Jan 26 23:54:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.210.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.215.207
description:
[2025-01-26 23:54:46 +0100] info [webmaild] 138.255.215.207 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-54.65.0.27.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.54.17
description:
Jan 26 23:54:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.54.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 26 23:54:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 26 23:53:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 26 23:54:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-26 23:54:30 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:12666: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-26 23:54:55 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:57344: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-26 23:55:08 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:41142: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-01-26 23:55:15 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:59093: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 26 23:55:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-26 23:55:54 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:34196: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 26 23:55:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 23:55:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Jan 26 23:55:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.11.106
description:
2025-01-26 23:55:20 dovecot_login authenticator failed for (107.11.22.218.broad.static.hf.ah.cndata.com) [218.22.11.106]:41238: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
description:
2025-01-26 23:55:56 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:39865: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.20.180
description:
2025-01-26 23:55:32 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:2968: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-26 23:55:42 dovecot_login authenticator failed for ([14.37.125.43]) [14.37.125.43]:46529: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 26 23:55:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.11.106
description:
Jan 26 23:55:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.11.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.20.180
description:
Jan 26 23:55:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.20.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
description:
Jan 26 23:55:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 23:55:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.248.26.21
description:
2025-01-26 23:56:34 dovecot_login authenticator failed for syn-067-248-026-021.res.spectrum.com [67.248.26.21]:47320: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
description:
2025-01-26 23:56:13 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:35846: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 26 23:56:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.248.26.21
description:
Jan 26 23:56:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.248.26.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-26 23:56:52 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:35258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.145
description:
2025-01-26 23:56:15 dovecot_login authenticator failed for 95.209.141.145.bredband.tre.se [95.209.141.145]:50886: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 26 23:56:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.209.141.145
description:
Jan 26 23:56:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.209.141.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 26 23:56:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
description:
Jan 26 23:56:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.93.103.240
description:
2025-01-26 23:57:50 dovecot_plain authenticator failed for (trampred) [142.93.103.240]:57030: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 26 23:57:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.14.85
description:
[2025-01-26 23:57:46 +0100] info [webmaild] 177.104.14.85 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.103.240
description:
Jan 26 23:57:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.103.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-26 23:57:05 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:46690: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 26 23:57:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-26 23:57:54 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:55965: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.249
description:
2025-01-26 23:58:25 dovecot_login authenticator failed for ([104.241.237.249]) [104.241.237.249]:49311: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.88.104
description:
2025-01-26 23:58:13 dovecot_login authenticator failed for ([1.235.88.104]) [1.235.88.104]:42817: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.88.104
description:
Jan 26 23:58:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.88.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
description:
2025-01-26 23:58:35 dovecot_login authenticator failed for ([116.113.253.142]) [116.113.253.142]:45812: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.198.37.128
description:
Jan 26 23:58:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.198.37.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.113.9.34
description:
Jan 26 23:58:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.113.9.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.142
description:
Jan 26 23:58:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 26 23:58:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 26 23:58:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.37
description:
Jan 26 23:58:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.37
description:
2025-01-26 23:58:13 dovecot_login authenticator failed for ([104.241.233.37]) [104.241.233.37]:38255: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 23:58:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.209.199
description:
Jan 26 23:58:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.209.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-26 23:58:42 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:32056: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-26 23:58:16 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:60530: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 26 23:58:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.123.208.246
description:
Jan 26 23:58:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.123.208.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.198.37.128
description:
2025-01-26 23:58:05 dovecot_plain authenticator failed for ([116.198.37.128]) [116.198.37.128]:48402: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.249
description:
Jan 26 23:58:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.209.199
description:
2025-01-26 23:58:29 dovecot_plain authenticator failed for ([177.44.209.199]) [177.44.209.199]:34654: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 79.137.203.224
domain: lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:23-58.79.137.203.224||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.113.9.34
description:
2025-01-26 23:58:54 dovecot_plain authenticator failed for ([111.113.9.34]) [111.113.9.34]:36704: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-26 23:59:19 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:33446: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Jan 26 23:59:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.178
description:
Jan 26 23:59:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
description:
2025-01-26 23:59:11 dovecot_plain authenticator failed for ([218.92.230.86]) [218.92.230.86]:62296: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.56.107.53
description:
Jan 26 23:59:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.56.107.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-01-26 23:59:27 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:40661: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-01-26 23:59:16 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:44496: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-01-26 23:59:24 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:53226: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 26 23:59:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.217
description:
2025-01-26 23:59:24 dovecot_login authenticator failed for ([104.241.238.217]) [104.241.238.217]:33194: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 26 23:59:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 26 23:59:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.230.86
description:
Jan 26 23:59:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.230.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-26 23:59:33 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:52264: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
description:
47.128.121.174 - - [26/Jan/2025:23:59:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7606835 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/09ae5c?panel=events" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 26 23:59:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.178
description:
2025-01-26 23:59:49 dovecot_login authenticator failed for ([197.250.7.67]) [41.220.129.178]:57918: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.56.107.53
description:
2025-01-26 23:59:12 dovecot_plain authenticator failed for ([191.56.107.53]) [191.56.107.53]:57788: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Jan 26 23:59:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.4.252
description:
[2025-01-27 00:00:20 +0100] info [webmaild] 181.78.4.252 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 27 00:01:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.125.94.195
description:
Jan 27 00:01:55 ait sshd[2534507]: Failed password for invalid user universitypublishing from 175.125.94.195 port 34944 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 00:00:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Jan 27 00:02:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Jan 27 00:02:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-27 00:01:37 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:42081: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-27 00:02:45 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:60909: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 00:00:29 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:41398: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-27 00:01:25 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:58048: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-27 00:00:09 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:53409: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 27 00:00:44 ait sshd[2534077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 27 00:01:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.250.139
description:
Jan 27 00:02:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 27 00:02:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-27 00:00:32 dovecot_plain authenticator failed for ([116.114.84.242]) [116.114.84.242]:33242: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
description:
Jan 27 00:01:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 00:01:53 ait sshd[2534507]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-27 00:02:32 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:52661: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
description:
2025-01-27 00:00:18 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:58746: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 27 00:01:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.129.114
description:
2025-01-27 00:00:43 dovecot_login authenticator failed for ([14.48.129.114]) [14.48.129.114]:52654: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 27 00:00:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 00:01:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 27 00:01:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-01-27 00:02:54 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:41542: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
description:
Jan 27 00:00:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 00:02:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 27 00:02:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-27 00:01:14 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:49335: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
description:
2025-01-27 00:01:33 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 27 00:00:44 ait sshd[2534077]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 00:01:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-01-27 00:02:56 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:53010: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 27 00:00:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
description:
Jan 27 00:00:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 00:01:02 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:54062: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 00:01:33 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:58797: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 00:01:53 ait sshd[2534507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.150.196
description:
2025-01-27 00:01:01 dovecot_plain authenticator failed for c188-149-150-196.bredband.tele2.se (insemi) [188.149.150.196]:49482: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-27 00:01:43 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:57769: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-01-27 00:02:43 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.250.139]:48568: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-27 00:00:50 dovecot_plain authenticator failed for ([58.218.163.130]) [58.218.163.130]:56654: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.150.196
description:
Jan 27 00:00:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.150.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-01-27 00:03:00 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:46390: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-01-27 00:03:18 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:57160: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.163
description:
2025-01-27 00:03:53 dovecot_plain authenticator failed for ([103.146.233.163]) [103.146.233.163]:54689: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.163
description:
Jan 27 00:03:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 27 00:03:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-27 00:03:10 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:19194: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
description:
Jan 27 00:03:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Jan 27 00:02:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
description:
Jan 27 00:03:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-01-27 00:03:38 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:62859: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.146.182.165
description:
[2025-01-27 00:04:53 +0100] info [webmaild] 197.146.182.165 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
description:
Jan 27 00:04:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Jan 27 00:04:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.105.182.88
description:
2025-01-27 00:04:36 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:42256: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 00:04:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.247.112.213
description:
[2025-01-27 00:03:58 +0100] info [webmaild] 177.247.112.213 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.33.2.165
description:
Jan 27 00:04:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.33.2.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.2.165
description:
2025-01-27 00:04:07 dovecot_plain authenticator failed for (gerable) [41.33.2.165]:55068: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.191.231
description:
[2025-01-27 00:05:32 +0100] info [webmaild] 143.202.191.231 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
description:
2025-01-27 00:04:58 dovecot_login authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:47162: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.139.182.67
description:
[2025-01-27 00:05:49 +0100] info [webmaild] 95.139.182.67 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-01-27 00:05:05 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:26234: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Jan 27 00:05:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
description:
Jan 27 00:05:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
description:
2025-01-27 00:05:18 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:51216: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 27 00:06:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-27 00:06:04 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:32938: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-27 00:06:16 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:56101: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-27 00:06:54 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:47598: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 27 00:06:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 27 00:06:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 27 00:06:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-27 00:06:44 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:44774: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
description:
2025-01-27 00:07:27 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:33164: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
description:
Jan 27 00:07:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.208
description:
2025-01-27 00:07:05 dovecot_plain authenticator failed for ([163.179.123.208]) [163.179.123.208]:38618: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 27 00:07:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.41.40
description:
2025-01-27 00:07:44 dovecot_plain authenticator failed for ([178.176.41.40]) [178.176.41.40]:50564: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 27 00:07:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-01-27 00:07:07 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:44275: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
description:
Jan 27 00:07:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-27 00:07:32 dovecot_plain authenticator failed for ([110.34.111.22]) [110.34.111.22]:36886: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 00:07:40 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:39835: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-27 00:07:56 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:40824: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 27 00:06:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Jan 27 00:07:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-27 00:07:22 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:53476: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.252.218
description:
Jan 27 00:07:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.252.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Jan 27 00:07:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-01-27 00:07:46 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:36510: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.208
description:
Jan 27 00:07:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 27 00:07:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
description:
2025-01-27 00:07:35 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:34256: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.176.41.40
description:
Jan 27 00:07:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.176.41.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-01-27 00:07:15 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:46924: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.110.192
description:
[2025-01-27 00:07:16 +0100] info [webmaild] 45.184.110.192 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.252.218
description:
2025-01-27 00:07:27 dovecot_plain authenticator failed for ([220.189.252.218]) [220.189.252.218]:47742: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.130.227.80
description:
Jan 27 00:07:34 ait sshd[2537033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.130.227.80  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-27 00:07:28 dovecot_plain authenticator failed for ([220.178.39.106]) [220.178.39.106]:37841: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 27 00:07:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.227.80
description:
Jan 27 00:07:34 ait sshd[2537033]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.130.227.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-27 00:07:00 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:31150: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-01-27 00:07:24 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:45083: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 00:07:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Jan 27 00:07:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Jan 27 00:07:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
description:
Jan 27 00:07:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-01-27 00:07:38 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:46121: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-01-27 00:08:31 dovecot_plain authenticator failed for (85.105.241.188.static.ttnet.com.tr) [85.105.241.188]:57078: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 27 00:08:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.152.161
description:
Jan 27 00:08:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-27 00:08:51 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:37846: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.38.104
description:
[2025-01-27 00:08:09 +0100] info [webmaild] 131.255.38.104 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
description:
Jan 27 00:08:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.152.161
description:
2025-01-27 00:08:46 dovecot_plain authenticator failed for (194.87.152.161-FTTB.planeta.tc) [194.87.152.161]:51680: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Jan 27 00:09:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.236.146
description:
Jan 27 00:09:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.236.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 27 00:09:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-27 00:09:36 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:51584: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.55.76.2
description:
2025-01-27 00:09:42 dovecot_plain authenticator failed for ppp005055076002.access.hol.gr [5.55.76.2]:58884: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.247.74
description:
2025-01-27 00:09:03 dovecot_plain authenticator failed for ([183.234.247.74]) [183.234.247.74]:50457: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-01-27 00:09:14 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:47404: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.5.159.34
description:
2025-01-27 00:09:18 dovecot_plain authenticator failed for ([45.5.159.34]) [45.5.159.34]:44184: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.236.146
description:
2025-01-27 00:09:50 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.236.146]:18760: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.52.103.241
description:
Jan 27 00:09:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.52.103.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.206.71.93
description:
[2025-01-27 00:09:43 +0100] info [webmaild] 105.206.71.93 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 27 00:09:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.95.217
description:
Jan 27 00:09:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.95.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
description:
2025-01-27 00:09:52 dovecot_plain authenticator failed for ([38.148.95.217]) [38.148.95.217]:41790: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Jan 27 00:09:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-01-27 00:09:44 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:34750: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.247.74
description:
Jan 27 00:09:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.247.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 27 00:09:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.246.91
description:
2025-01-27 00:09:36 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:41864: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.5.159.34
description:
Jan 27 00:09:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.5.159.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.52.103.241
description:
2025-01-27 00:09:35 dovecot_plain authenticator failed for ([14.52.103.241]) [14.52.103.241]:50956: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.55.76.2
description:
Jan 27 00:09:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.55.76.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.177.167.211
description:
[2025-01-27 00:09:37 +0100] info [webmaild] 102.177.167.211 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-27 00:09:50 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:36668: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 00:10:40 ait sshd[2538277]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 00:10:40 ait sshd[2538277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 27 00:10:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
description:
Jan 27 00:10:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 27 00:10:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
description:
Jan 27 00:10:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Jan 27 00:10:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-01-27 00:10:26 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:57718: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-27 00:10:33 dovecot_login authenticator failed for ([218.22.187.68]) [218.22.187.66]:56379: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Jan 27 00:10:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
description:
Jan 27 00:10:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
description:
2025-01-27 00:10:46 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:48076: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-27 00:10:19 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:36468: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Jan 27 00:10:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-01-27 00:10:30 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:46712: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
description:
Jan 27 00:10:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-27 00:10:41 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:49050: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-27 00:10:43 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:39259: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-01-27 00:10:47 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:48326: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Jan 27 00:10:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
description:
2025-01-27 00:10:29 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:61604: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-27 00:10:47 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:54454: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
description:
2025-01-27 00:10:48 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:37345: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 27 00:10:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-27 00:10:34 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:57665: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 27 00:10:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-01-27 00:11:55 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:32940: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Jan 27 00:11:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
description:
Jan 27 00:10:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
description:
2025-01-27 00:11:01 dovecot_plain authenticator failed for ([222.235.82.88]) [222.235.82.88]:56474: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-27 00:11:03 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:55818: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 27 00:11:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-27 00:11:45 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:58178: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-01-27 00:11:35 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:52734: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 27 00:11:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 27 00:11:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 00:12:15 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:34578: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Jan 27 00:12:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 27 00:12:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-01-27 00:12:00 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:47035: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Jan 27 00:12:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 00:12:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-27 00:12:16 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:45043: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 27 00:12:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 27 00:12:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-27 00:12:04 dovecot_plain authenticator failed for ([91.234.132.226]) [91.234.132.226]:36491: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-01-27 00:12:12 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:47723: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-01-27 00:12:09 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:50894: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-27 00:12:29 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:34021: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Jan 27 00:11:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 00:12:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 27 00:13:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Jan 27 00:13:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Jan 27 00:13:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 27 00:13:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-27 00:13:06 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:62857: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Jan 27 00:13:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-27 00:13:19 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:57672: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
description:
2025-01-27 00:13:06 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:47825: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-01-27 00:13:25 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:58939: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-27 00:13:30 dovecot_plain authenticator failed for (sclingert) [149.0.19.108]:40502: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-27 00:14:28 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:34777: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 00:14:40 ait sshd[2539582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 27 00:14:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
description:
Jan 27 00:14:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 27 00:14:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-27 00:14:47 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:52879: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 00:14:40 ait sshd[2539582]: Invalid user kleine-kunst-akademie-sehlis.de 2a00 from 122.51.104.242 port 53714


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.53
description:
Jan 27 00:14:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.178.210.103
description:
[2025-01-27 00:14:15 +0100] info [webmaild] 178.178.210.103 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 00:14:40 ait sshd[2539582]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
description:
2025-01-27 00:14:51 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:35982: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
description:
2025-01-27 00:14:19 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:50812: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 27 00:14:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-27 00:14:36 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:35550: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
description:
Jan 27 00:15:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
description:
2025-01-27 00:15:07 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:34724: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 00:15:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Jan 27 00:14:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 27 00:15:33 ait sshd[2540256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 27 00:15:33 ait sshd[2540256]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-01-27 00:15:01 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:44006: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-27 00:15:02 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:44799: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 00:15:24 ait sshd[2540218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 00:15:24 ait sshd[2540218]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 00:14:55 ait sshd[2539732]: Failed password for invalid user kleine-kunst-akademie-sehlis.de 2a00 from 122.51.104.242 port 58330 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 27 00:15:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 00:15:58 ait sshd[2540455]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
description:
Jan 27 00:16:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.159.90
description:
2025-01-27 00:16:26 dovecot_login authenticator failed for (CzAX4V) [185.208.159.90]:61172: 535 Incorrect authentication data (set_id=addo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 00:15:58 ait sshd[2540455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
description:
Jan 27 00:16:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.159.90
description:
Jan 27 00:16:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.159.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
description:
2025-01-27 00:16:09 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:48701: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-27 00:16:33 dovecot_plain authenticator failed for (coths) [94.140.210.134]:48709: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 27 00:16:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.189.207
description:
[2025-01-27 00:16:34 +0100] info [webmaild] 45.180.189.207 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Jan 27 00:16:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
description:
2025-01-27 00:16:20 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:47808: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-01-27 00:16:46 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:58347: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.159.90
description:
Jan 27 00:17:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.159.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.159.90
description:
2025-01-27 00:17:10 dovecot_login authenticator failed for (xkn1anbqr) [185.208.159.90]:54217: 535 Incorrect authentication data (set_id=addo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Jan 27 00:17:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 27 00:17:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.37.171.161
description:
Jan 27 00:16:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.37.171.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-27 00:17:07 dovecot_plain authenticator failed for ([37.57.69.227]) [37.57.69.227]:44488: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-27 00:17:47 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:42160: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.171.161
description:
2025-01-27 00:16:58 dovecot_plain authenticator failed for ([59.37.171.161]) [59.37.171.161]:35864: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-01-27 00:16:59 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:59160: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 27 00:17:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 27 00:17:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-27 00:17:12 dovecot_plain authenticator failed for ([220.90.239.158]) [220.90.239.158]:27268: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-01-27 00:17:24 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:39457: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Jan 27 00:16:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.231.207
description:
Jan 27 00:18:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.231.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.22.35.102
description:
[2025-01-27 00:18:47 +0100] info [webmaild] 187.22.35.102 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.133.87
description:
Jan 27 00:17:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.133.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.133.87
description:
2025-01-27 00:17:58 dovecot_plain authenticator failed for (223-197-133-87.static.imsbiz.com) [223.197.133.87]:53791: 535 Incorrect authentication data (set_id=abs68b66600y)


