# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
description:
Jan 26 13:09:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 26 13:08:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 13:09:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 26 13:09:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.131
description:
Jan 26 13:08:37 ait sshd[2241009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-26 13:08:44 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:57841: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
description:
Jan 26 13:08:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.127.149
description:
Jan 26 13:08:48 ait sshd[2241041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 87.201.127.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.179.58
description:
2025-01-26 13:08:27 dovecot_login authenticator failed for ([122.224.179.58]) [122.224.179.58]:46183: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-26 13:09:26 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:52760: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-26 13:09:55 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:46044: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Jan 26 13:10:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-01-26 13:10:07 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:56056: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 26 13:10:16 ait sshd[2242075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 26 13:10:16 ait sshd[2242075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 26 13:09:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 13:10:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 108.165.243.50
domain: www.lemsas.net
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/ioxi/retu.php||WPU:||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.47
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/about.php||SC:/home/lemsas/public_html/wp-includes


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 26 13:10:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.162.75
description:
Jan 26 13:10:44 ait sshd[2242179]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.162.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-26 13:10:43 dovecot_plain authenticator failed for (dully) [77.239.255.163]:33898: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.126.201
description:
Jan 26 13:10:47 ait sshd[2242190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.126.126.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.40
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-10.108.165.243.40||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.47
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-11.108.165.243.47||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.162.75
description:
Jan 26 13:10:44 ait sshd[2242179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.162.75


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.40
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/Mhbgf.php||SC:/home/lemsas/public_html/wp-admin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
description:
Jan 26 13:11:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.126.126.201
description:
Jan 26 13:10:47 ait sshd[2242190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.126.126.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
description:
2025-01-26 13:11:15 dovecot_login authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:56030: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.193.7
description:
2025-01-26 13:12:22 dovecot_login authenticator failed for ([120.194.193.7]) [120.194.193.7]:43616: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-26 13:12:24 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:43344: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.56.11.17
description:
Jan 26 13:12:03 ait sshd[2242571]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.56.11.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.45
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-12.108.165.243.45||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 26 13:12:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 13:11:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.43
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-11.108.165.243.43||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.45
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/lemsas/public_html/wp-admin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.193.7
description:
Jan 26 13:12:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.193.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.43
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/lemsas/public_html/wp-content


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.56.11.17
description:
Jan 26 13:12:03 ait sshd[2242571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.56.11.17


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 108.165.243.39
domain: www.lemsas.net
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:6.65||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-26 13:12:47 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:39180: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-01-26 13:12:43 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:50140: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 87.201.127.149
description:
Jan 26 13:13:19 ait sshd[2243103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.201.127.149


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.33
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/lemsas/public_html/wp-admin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 13:12:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 26 13:12:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-26 13:12:59 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:34324: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.155.21.198
description:
Jan 26 13:13:06 ait sshd[2242936]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.155.21.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.155.21.198
description:
Jan 26 13:13:06 ait sshd[2242936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.155.21.198


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.127.149
description:
Jan 26 13:13:19 ait sshd[2243103]: pam_imunify(sshd:auth): [IM360_RBL] The IP 87.201.127.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-26 13:13:24 dovecot_plain authenticator failed for (fosoma) [81.211.77.58]:3243: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 26 13:12:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 26 13:13:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Jan 26 13:12:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.249.224.46
description:
Jan 26 13:12:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.249.224.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.249.224.46
description:
2025-01-26 13:12:55 dovecot_plain authenticator failed for c83-249-224-46.bredband.tele2.se (faine) [83.249.224.46]:33992: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 26 13:13:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.33
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-12.108.165.243.33||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.126.201
description:
Jan 26 13:13:39 ait sshd[2243191]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.126.126.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 13:14:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.52
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-14.108.165.243.52||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 13:13:26 ait sshd[2243124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 13:13:28 ait sshd[2243145]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
description:
2025-01-26 13:13:29 dovecot_plain authenticator failed for (glecons) [65.20.184.80]:49639: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.59
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-14.108.165.243.59||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 108.165.243.49
domain: www.lemsas.net
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 26 13:13:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 26 13:13:26 ait sshd[2243124]: Invalid user r8-revolver-fade.pro 2606 from 111.231.56.128 port 45934


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 13:13:26 ait sshd[2243124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 26 13:13:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.126.126.201
description:
Jan 26 13:13:39 ait sshd[2243191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.126.126.201


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.59
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/lemsas/public_html/wp-admin


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.34
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/lemsas/public_html/wp-includes


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.34
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-14.108.165.243.34||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.184.80
description:
Jan 26 13:13:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 13:13:28 ait sshd[2243145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.52
domain: www.lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/about.php||SC:/home/lemsas/public_html/wp-content


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 26 13:15:16 ait sshd[2244388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.161.123
description:
Jan 26 13:14:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.161.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 26 13:15:16 ait sshd[2244388]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 108.165.243.39
domain: www.lemsas.net
description:
IM360 WAF: Block interaction with malicious plugin||RSV:6.65||T:APACHE||SC:/home/lemsas/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 26 13:15:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 26 13:14:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 26 13:14:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.56.11.17
description:
Jan 26 13:14:52 ait sshd[2243847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.56.11.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.193.106.140
description:
2025-01-26 13:15:05 dovecot_plain authenticator failed for ([122.193.106.140]) [122.193.106.140]:36311: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 87.201.127.149
description:
Jan 26 13:14:45 ait sshd[2243782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.201.127.149


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 26 13:15:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Jan 26 13:15:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.126.126.201
description:
Jan 26 13:14:54 ait sshd[2243857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.126.126.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-26 13:14:55 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:49795: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-26 13:15:09 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:45552: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
description:
Jan 26 13:14:30 ait sshd[2243477]: Failed password for invalid user deploy from 43.155.21.198 port 45342 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.104.38
description:
Jan 26 13:14:34 ait sshd[2243700]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.115.104.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.131
description:
Jan 26 13:14:43 ait sshd[2243774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.131


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.127.149
description:
Jan 26 13:14:45 ait sshd[2243782]: pam_imunify(sshd:auth): [IM360_RBL] The IP 87.201.127.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.56.11.17
description:
Jan 26 13:14:52 ait sshd[2243847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.56.11.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-26 13:15:10 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:60868: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-01-26 13:15:15 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:33763: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-26 13:14:51 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:54886: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350296
name: IM360: Block access to the shell
abuser: 108.165.243.42
domain: www.lemsas.net
description:
IM360: Block access to the shell||MV:/ticket/vendor/htmlawed/htmlawed/gel4y.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.155.21.198
description:
Jan 26 13:14:28 ait sshd[2243477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.155.21.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.161.123
description:
2025-01-26 13:14:31 dovecot_login authenticator failed for ([93.182.161.123]) [93.182.161.123]:35116: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.115.104.38
description:
Jan 26 13:14:34 ait sshd[2243700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.115.104.38  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-26 13:14:47 dovecot_plain authenticator failed for (whiza) [82.84.122.203]:63265: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 26 13:14:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.131
description:
Jan 26 13:14:43 ait sshd[2243774]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.133.2
description:
Jan 26 13:14:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.133.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
description:
2025-01-26 13:14:52 dovecot_login authenticator failed for syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:59779: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 13:15:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 26 13:15:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-26 13:15:17 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:46592: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.155.21.198
description:
Jan 26 13:14:28 ait sshd[2243477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.155.21.198


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.126.201
description:
Jan 26 13:14:54 ait sshd[2243857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.126.126.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.210
description:
Jan 26 13:14:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.210
description:
2025-01-26 13:15:01 dovecot_login authenticator failed for ([104.241.237.210]) [104.241.237.210]:55257: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 108.165.243.53
domain: www.lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/sid/sidwso.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
description:
Jan 26 13:15:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 26 13:15:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 26 13:15:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.163.242.126
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:13-16.95.163.242.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.205.244.221
description:
Jan 26 13:15:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.205.244.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 26 13:16:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-26 13:16:16 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53096: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
description:
2025-01-26 13:15:44 dovecot_login authenticator failed for ([183.249.1.112]) [183.249.1.112]:34563: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.237.108
description:
Jan 26 13:15:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
description:
Jan 26 13:15:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
description:
2025-01-26 13:15:59 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:15704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-26 13:16:03 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:41997: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Jan 26 13:16:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.65.24
description:
Jan 26 13:15:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.65.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-26 13:15:44 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:10184: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.208
description:
Jan 26 13:15:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.205.244.221
description:
2025-01-26 13:15:57 dovecot_login authenticator failed for (191-205-244-221.user.vivozap.com.br) [191.205.244.221]:41858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
description:
2025-01-26 13:15:51 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:47822: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
description:
Jan 26 13:16:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-01-26 13:16:02 dovecot_plain authenticator failed for ([27.188.73.223]) [27.188.73.223]:35482: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-26 13:15:45 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:36854: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 26 13:16:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
description:
2025-01-26 13:16:03 dovecot_login authenticator failed for ([45.165.170.41]) [45.165.170.41]:46312: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.53
domain: www.lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-15.108.165.243.53||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
description:
2025-01-26 13:15:42 dovecot_login authenticator failed for ([102.221.65.24]) [102.221.65.24]:37776: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
description:
2025-01-26 13:15:54 dovecot_plain authenticator failed for ([218.22.237.108]) [218.22.237.108]:52584: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Jan 26 13:16:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
description:
2025-01-26 13:17:21 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:50705: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.162.75
description:
Jan 26 13:17:24 ait sshd[2245901]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.162.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.162.75
description:
Jan 26 13:17:24 ait sshd[2245901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.162.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.14
description:
[2025-01-26 13:17:00 +0100] info [cpaneld] 104.207.61.14 - gyn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gyn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.225
description:
[2025-01-26 13:17:16 +0100] info [cpaneld] 104.207.56.225 - dgyan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgyan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.119
description:
[2025-01-26 13:17:17 +0100] info [whostmgrd] 104.207.63.119 - dgyan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.197
description:
[2025-01-26 13:17:18 +0100] info [whostmgrd] 104.207.48.197 - dgyan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.109.20.192
description:
Jan 26 13:17:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.109.20.192 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.89
description:
[2025-01-26 13:16:58 +0100] info [cpaneld] 104.207.49.89 - gyn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gyn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.48
description:
[2025-01-26 13:16:59 +0100] info [cpaneld] 104.207.35.48 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.37
description:
[2025-01-26 13:17:00 +0100] info [whostmgrd] 104.207.61.37 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.87
description:
[2025-01-26 13:17:16 +0100] info [whostmgrd] 104.207.47.87 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.141.101.237
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:13-17.94.141.101.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Jan 26 13:16:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.92.201
description:
[2025-01-26 13:17:01 +0100] info [whostmgrd] 156.228.92.201 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.109
description:
[2025-01-26 13:17:18 +0100] info [whostmgrd] 104.207.36.109 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-01-26 13:16:28 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:39286: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.179
description:
[2025-01-26 13:17:10 +0100] info [cpaneld] 104.207.44.179 - dgyan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgyan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.168
description:
[2025-01-26 13:17:11 +0100] info [cpaneld] 156.228.78.168 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.97.90
description:
[2025-01-26 13:17:15 +0100] info [cpaneld] 156.228.97.90 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.79.112
description:
[2025-01-26 13:16:59 +0100] info [cpaneld] 156.228.79.112 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.164
description:
[2025-01-26 13:17:01 +0100] info [whostmgrd] 156.228.89.164 - gyn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.12
description:
[2025-01-26 13:17:02 +0100] info [whostmgrd] 156.228.102.12 - gyn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.99
description:
[2025-01-26 13:17:03 +0100] info [whostmgrd] 104.207.52.99 - gyn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 13:16:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
description:
2025-01-26 13:16:45 dovecot_login authenticator failed for ([116.116.156.198]) [116.116.156.198]:33325: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.81
description:
[2025-01-26 13:17:02 +0100] info [whostmgrd] 156.228.85.81 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.171
description:
[2025-01-26 13:17:00 +0100] info [cpaneld] 156.228.117.171 - gyn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gyn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.253
description:
[2025-01-26 13:17:16 +0100] info [cpaneld] 104.207.40.253 - dgyan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgyan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.62.230
description:
[2025-01-26 13:17:17 +0100] info [whostmgrd] 104.207.62.230 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-26 13:17:45 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:37848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.246.138.100
description:
Jan 26 13:17:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.246.138.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-26 13:17:49 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:56047: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 26 13:17:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Jan 26 13:18:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
description:
2025-01-26 13:18:08 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:47006: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-26 13:17:31 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:52749: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 26 13:17:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-26 13:17:46 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:33872: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Jan 26 13:17:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-01-26 13:17:50 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.250.139]:29202: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-01-26 13:18:04 dovecot_login authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:48051: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-26 13:17:33 dovecot_login authenticator failed for ([103.178.158.133]) [103.178.158.132]:39596: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-26 13:17:35 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:39526: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Jan 26 13:17:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-26 13:17:44 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38637: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-26 13:18:23 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:60172: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-26 13:18:02 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:46988: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Jan 26 13:17:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-01-26 13:17:38 dovecot_login authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:54774: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 26 13:17:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-26 13:17:46 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:40519: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 26 13:17:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-01-26 13:17:49 dovecot_login authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:38882: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.138.100
description:
2025-01-26 13:17:51 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:35004: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Jan 26 13:18:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-01-26 13:18:05 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:39502: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-26 13:18:06 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:51999: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 26 13:18:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 26 13:17:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 26 13:17:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 26 13:17:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 26 13:17:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-26 13:17:58 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:39712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 26 13:18:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.48.162.75
description:
Jan 26 13:17:27 ait sshd[2245901]: Disconnected from invalid user admin 120.48.162.75 port 59032 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.250.139
description:
Jan 26 13:17:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 26 13:18:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 26 13:18:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 26 13:19:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 26 13:18:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 26 13:19:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-26 13:19:15 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:35014: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-26 13:19:19 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:33707: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.0.78.32
description:
Jan 26 13:18:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.0.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-26 13:19:00 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:55316: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-26 13:19:06 dovecot_login authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:49748: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 26 13:19:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-26 13:19:11 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:48590: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 26 13:19:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.77
description:
Jan 26 13:18:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 26 13:19:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.218
description:
Jan 26 13:19:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.218
description:
2025-01-26 13:19:06 dovecot_login authenticator failed for ([195.178.110.218]) [195.178.110.218]:53606: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.77
description:
2025-01-26 13:19:01 dovecot_login authenticator failed for ([111.61.176.77]) [111.61.176.77]:16554: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-01-26 13:20:20 dovecot_login authenticator failed for ([111.124.47.11]) [111.124.47.11]:32976: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 26 13:19:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.81
description:
[2025-01-26 13:19:38 +0100] info [cpaneld] 156.228.85.81 - ads19a00054y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00054y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Jan 26 13:19:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-01-26 13:19:59 dovecot_login authenticator failed for ([211.93.22.218]) [211.93.22.218]:41838: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Jan 26 13:20:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
description:
Jan 26 13:20:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-01-26 13:20:04 dovecot_login authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:65360: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.15
description:
[2025-01-26 13:19:37 +0100] info [cpaneld] 156.228.119.15 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.209
description:
[2025-01-26 13:19:38 +0100] info [cpaneld] 104.207.55.209 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.89
description:
[2025-01-26 13:19:38 +0100] info [cpaneld] 156.228.95.89 - ads19a00054y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00054y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.63
description:
[2025-01-26 13:19:39 +0100] info [whostmgrd] 156.228.102.63 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.97
description:
[2025-01-26 13:19:40 +0100] info [whostmgrd] 156.228.84.97 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 26 13:19:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.4
description:
[2025-01-26 13:19:41 +0100] info [whostmgrd] 156.228.87.4 - ads19a00054y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.56
description:
[2025-01-26 13:19:37 +0100] info [cpaneld] 104.207.38.56 - ads19a00054y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00054y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.37.206
description:
[2025-01-26 13:19:39 +0100] info [whostmgrd] 104.207.37.206 - ads19a00054y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 26 13:19:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.168
description:
[2025-01-26 13:19:40 +0100] info [whostmgrd] 156.228.101.168 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-26 13:19:41 dovecot_login authenticator failed for ([211.57.111.99]) [211.57.111.99]:40410: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-26 13:19:43 dovecot_login authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:3442: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-26 13:20:01 dovecot_login authenticator failed for ([211.221.130.246]) [211.221.130.246]:36602: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.0.78.32
description:
2025-01-26 13:21:07 dovecot_login authenticator failed for fl-71-0-78-32.dhcp.embarqhsd.net [71.0.78.32]:59302: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.215.212.160
description:
2025-01-26 13:21:16 dovecot_plain authenticator failed for 218-215-212-160.sta.wbroadband.net.au [218.215.212.160]:41734: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 26 13:20:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
description:
2025-01-26 13:20:47 dovecot_login authenticator failed for ([183.249.1.72]) [183.249.1.72]:60263: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.131
description:
Jan 26 13:20:50 ait sshd[2248351]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.131
description:
Jan 26 13:20:50 ait sshd[2248351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 26 13:20:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
description:
2025-01-26 13:20:58 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:42974: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.147.190
description:
2025-01-26 13:20:41 dovecot_login authenticator failed for 213-91-147-190.ip.btc-net.bg [213.91.147.190]:33440: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.34.28
description:
2025-01-26 13:20:59 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:34761: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Jan 26 13:20:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 26 13:20:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
description:
Jan 26 13:20:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.34.28
description:
Jan 26 13:20:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.0.78.32
description:
Jan 26 13:21:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.0.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.215.212.160
description:
Jan 26 13:21:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.215.212.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.91.147.190
description:
Jan 26 13:20:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.91.147.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.144.33.209
description:
Jan 26 13:20:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.144.33.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 26 13:20:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
description:
Jan 26 13:20:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-26 13:20:38 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:51992: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-01-26 13:20:44 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:51310: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-26 13:20:45 dovecot_plain authenticator failed for (scalmird) [91.116.42.218]:53978: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-01-26 13:20:53 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:41447: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-26 13:20:56 dovecot_login authenticator failed for ([211.105.223.49]) [211.105.223.49]:37120: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-26 13:20:34 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:44094: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 26 13:20:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-26 13:20:57 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:59945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-26 13:21:55 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:46440: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 26 13:21:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 26 13:22:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-26 13:22:06 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:48315: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.171
description:
Jan 26 13:21:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 26 13:21:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 26 13:21:40 ait sshd[2248870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-26 13:21:43 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:59512: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-26 13:21:52 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:45600: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
description:
Jan 26 13:22:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 26 13:21:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
description:
2025-01-26 13:21:47 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:42820: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
description:
2025-01-26 13:22:11 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:41405: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
description:
2025-01-26 13:21:37 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:61240: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 26 13:21:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
description:
Jan 26 13:21:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 26 13:21:40 ait sshd[2248870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
description:
2025-01-26 13:21:44 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:60477: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 26 13:21:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-26 13:21:32 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:36918: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
description:
Jan 26 13:21:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-26 13:21:59 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:59420: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 26 13:22:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-26 13:22:47 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:35724: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.101.117
description:
Jan 26 13:23:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.101.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.114.41
description:
Jan 26 13:23:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.114.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 26 13:22:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-26 13:22:58 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:35261: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 26 13:23:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-26 13:22:45 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:44926: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 26 13:22:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.2.207
description:
Jan 26 13:23:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.2.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 26 13:22:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-26 13:23:20 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:7268: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-26 13:22:31 dovecot_login authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:56375: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-26 13:24:12 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:8226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.17.66
description:
Jan 26 13:24:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.17.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-26 13:23:57 dovecot_login authenticator failed for ([58.240.2.38]) [58.240.2.38]:45560: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 26 13:24:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.185.121
description:
Jan 26 13:24:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.185.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.215.23
description:
Jan 26 13:23:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.215.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.101.117
description:
Jan 26 13:23:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.101.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.219.194
description:
Jan 26 13:23:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.219.194 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.115.199
description:
47.128.115.199 - - [26/Jan/2025:13:23:44 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8609855 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=30&filter_course-language=121%2C99%2C198%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.115.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 26 13:23:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.215.23
description:
2025-01-26 13:23:29 dovecot_plain authenticator failed for (ws23-215.199.103.rcil.gov.in) [103.199.215.23]:47414: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.202
description:
Jan 26 13:23:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Jan 26 13:23:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 26 13:23:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-26 13:25:01 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:55976: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.2.202
description:
Jan 26 13:25:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.2.202
description:
2025-01-26 13:25:14 dovecot_login authenticator failed for ([221.224.2.202]) [221.224.2.202]:33403: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 26 13:25:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.17.66
description:
Jan 26 13:24:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.17.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 13:24:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.207.209
description:
2025-01-26 13:25:13 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.207.209]:46094: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 26 13:25:01 ait sshd[2250783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 52.159.118.201
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-25.52.159.118.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.96.207.209
description:
Jan 26 13:25:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.96.207.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 26 13:24:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Jan 26 13:24:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 26 13:24:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 26 13:25:01 ait sshd[2250783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-26 13:25:25 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:60213: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 13:25:41 ait sshd[2251154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 26 13:25:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 26 13:25:53 ait sshd[2251265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.162.75
description:
Jan 26 13:25:59 ait sshd[2251274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.162.75


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.134
description:
Jan 26 13:26:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 26 13:26:15 ait sshd[2251434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 26 13:25:40 ait sshd[2251154]: Invalid user r8-revolver-fade.pro 2606 from 111.231.56.128 port 53222


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 13:25:41 ait sshd[2251154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-26 13:25:43 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:39614: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 26 13:25:53 ait sshd[2251265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.162.75
description:
Jan 26 13:25:59 ait sshd[2251274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.162.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.0.78.32
description:
Jan 26 13:26:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.0.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.225.169
description:
Jan 26 13:25:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.225.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.225.169
description:
2025-01-26 13:25:30 dovecot_login authenticator failed for net-2-37-225-169.cust.vodafonedsl.it [2.37.225.169]:48993: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.0.78.32
description:
2025-01-26 13:26:12 dovecot_login authenticator failed for fl-71-0-78-32.dhcp.embarqhsd.net [71.0.78.32]:38314: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.134
description:
2025-01-26 13:26:27 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:51310: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-01-26 13:27:25 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:64804: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.237.171.228
description:
2025-01-26 13:26:44 dovecot_login authenticator failed for ec2-34-237-171-228.compute-1.amazonaws.com (ait.edu.gh) [34.237.171.228]:54255: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Jan 26 13:27:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.237.171.228
description:
Jan 26 13:26:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.237.171.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 26 13:27:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 13:27:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 26 13:27:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.1.9
description:
Jan 26 13:28:20 ait sshd[2252397]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.186.1.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.230.95.235
description:
Jan 26 13:27:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.230.95.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.230.95.235
description:
2025-01-26 13:27:36 dovecot_plain authenticator failed for (abts-ap-dynamic-235.95.230.223.airtelbroadband.in) [223.230.95.235]:58566: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-26 13:28:00 dovecot_login authenticator failed for ([58.240.2.38]) [58.240.2.38]:37825: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.186.1.9
description:
Jan 26 13:28:20 ait sshd[2252397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.186.1.9


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-26 13:27:55 dovecot_login authenticator failed for ([221.215.87.163]) [221.215.87.163]:58826: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 26 13:27:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 26 13:28:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-26 13:28:16 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:35913: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 26 13:28:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-26 13:27:33 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:59012: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 154.161.182.42
domain: iric.us
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=50&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-26 13:28:31 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:36386: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 26 13:28:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 26 13:29:00 ait sshd[2252719]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 26 13:29:09 ait sshd[2252786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
description:
2025-01-26 13:29:22 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:53728: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 26 13:28:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 26 13:28:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-01-26 13:29:22 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:53988: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.52.115.48
description:
Jan 26 13:28:53 ait sshd[2252668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.52.115.48  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 26 13:28:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-26 13:28:55 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:20321: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 26 13:29:00 ait sshd[2252719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-26 13:29:00 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:60213: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
description:
Jan 26 13:29:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-26 13:28:28 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:60752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.52.115.48
description:
Jan 26 13:28:53 ait sshd[2252668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.52.115.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-26 13:29:01 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:41518: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 26 13:29:09 ait sshd[2252786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Jan 26 13:29:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 26 13:29:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
description:
2025-01-26 13:29:32 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:56902: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 26 13:29:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-26 13:30:09 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:42787: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 26 13:29:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Jan 26 13:30:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.64.208.83
description:
Jan 26 13:29:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.64.208.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
description:
Jan 26 13:29:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.64.208.83
description:
2025-01-26 13:29:32 dovecot_login authenticator failed for ([185.64.208.83]) [185.64.208.83]:52941: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.254.162
description:
Jan 26 13:29:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-26 13:29:46 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:42628: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.254.162
description:
2025-01-26 13:29:47 dovecot_plain authenticator failed for ([223.71.254.162]) [223.71.254.162]:46595: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-26 13:29:49 dovecot_plain authenticator failed for ([188.226.47.211]) [188.226.47.211]:57936: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.82
description:
Jan 26 13:29:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.88.22
description:
Jan 26 13:29:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.88.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
description:
2025-01-26 13:29:58 dovecot_plain authenticator failed for ([180.94.74.82]) [180.94.74.82]:43092: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.88.22
description:
2025-01-26 13:29:58 dovecot_plain authenticator failed for ([61.150.88.22]) [61.150.88.22]:59293: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 26 13:30:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-01-26 13:30:21 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:39956: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-26 13:29:34 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:45184: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 13:31:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 26 13:31:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-26 13:31:22 dovecot_plain authenticator failed for ([121.202.154.250]) [121.202.154.250]:9221: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 26 13:31:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-26 13:31:45 dovecot_plain authenticator failed for ([116.231.84.13]) [116.231.84.13]:50500: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 13:31:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Jan 26 13:31:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-01-26 13:31:57 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:51640: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 13:31:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.246.89.195
description:
Jan 26 13:31:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.246.89.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.89.195
description:
2025-01-26 13:31:34 dovecot_login authenticator failed for ([183.246.89.195]) [183.246.89.195]:58589: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.52.115.48
description:
Jan 26 13:33:17 ait sshd[2255706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.52.115.48


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 26 13:32:26 ait sshd[2255154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 26 13:33:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.52.115.48
description:
Jan 26 13:33:17 ait sshd[2255706]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.52.115.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Jan 26 13:33:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
description:
2025-01-26 13:33:22 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:45984: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.1.9
description:
Jan 26 13:33:17 ait sshd[2255701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.186.1.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.186.1.9
description:
Jan 26 13:33:17 ait sshd[2255701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.186.1.9


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-26 13:33:14 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:41684: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 26 13:32:26 ait sshd[2255154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 26 13:32:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
description:
2025-01-26 13:33:00 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:34845: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 13:33:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Jan 26 13:33:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-01-26 13:33:32 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:50656: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/images/images/data1/images/data1/engine1/engine1/data1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Jan 26 13:34:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.186.1.9
description:
Jan 26 13:34:52 ait sshd[2256576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.186.1.9  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 26 13:35:24 ait sshd[2256912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.52.115.48
description:
Jan 26 13:34:50 ait sshd[2256565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.52.115.48  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.52.209.104
description:
Jan 26 13:34:59 ait sshd[2256663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.52.209.104


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 26 13:35:12 ait sshd[2256875]: Invalid user r8-revolver-fade.pro 2606 from 111.231.56.128 port 46316


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.196
description:
47.128.22.196 - - [26/Jan/2025:13:34:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17300627 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/53a2e9?panel=config" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-01-26 13:34:37 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:40773: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
description:
Jan 26 13:34:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
description:
2025-01-26 13:34:46 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:49377: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 13:35:12 ait sshd[2256875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 13:35:12 ait sshd[2256875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.52.115.48
description:
Jan 26 13:34:50 ait sshd[2256565]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.52.115.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.1.9
description:
Jan 26 13:34:52 ait sshd[2256576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.186.1.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 26 13:36:22 ait sshd[2257382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 13:35:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.52.209.104
description:
Jan 26 13:35:41 ait sshd[2257114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.52.209.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 26 13:36:22 ait sshd[2257382]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/images/images/data1/images/data1/engine1/engine1/data1/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 13:35:33 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tormings) [87.103.126.54]:28361: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/images/images/data1/images/data1/engine1/engine1/js/js/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
description:
2025-01-26 13:36:38 dovecot_login authenticator failed for ([111.61.176.243]) [111.61.176.243]:11222: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 26 13:36:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 26 13:37:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 26 13:37:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Jan 26 13:37:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-01-26 13:37:08 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:55016: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 13:37:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Jan 26 13:37:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 26 13:36:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-26 13:36:44 dovecot_login authenticator failed for ([60.223.252.57]) [60.223.252.57]:56724: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-26 13:36:49 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:55807: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-26 13:37:05 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:11346: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 26 13:36:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-26 13:37:04 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:56825: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-01-26 13:37:19 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:63095: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.66.14
description:
2025-01-26 13:38:32 dovecot_login authenticator failed for (ait.edu.gh) [45.88.66.14]:20281: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-26 13:37:50 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:14008: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
description:
2025-01-26 13:38:00 dovecot_login authenticator failed for ([111.61.175.117]) [111.61.175.117]:56638: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-26 13:38:04 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:56416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-26 13:38:18 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:36872: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-01-26 13:37:37 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:42872: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Jan 26 13:37:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 26 13:37:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 26 13:37:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.117
description:
Jan 26 13:37:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.88.66.14
description:
Jan 26 13:38:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.88.66.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.57.55
description:
2025-01-26 13:37:37 dovecot_login authenticator failed for (55.57.251.198.in-addr.arpa) [198.251.57.55]:50924: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-01-26 13:37:40 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:37478: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-26 13:37:51 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:54292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 26 13:38:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 26 13:38:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-01-26 13:38:39 dovecot_login authenticator failed for ([219.248.65.30]) [219.248.65.30]:52916: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 26 13:38:42 ait sshd[2258733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-01-26 13:39:07 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:34606: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-01-26 13:38:57 dovecot_login authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:45544: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 26 13:39:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/engine1/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.165
description:
Jan 26 13:38:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Jan 26 13:38:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Jan 26 13:39:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Jan 26 13:38:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 26 13:38:42 ait sshd[2258733]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.165
description:
2025-01-26 13:38:49 dovecot_login authenticator failed for ([218.149.228.165]) [218.149.228.165]:43329: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-26 13:39:02 dovecot_plain authenticator failed for (overid) [65.20.183.209]:56694: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Jan 26 13:39:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.197.38
description:
Jan 26 13:39:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.197.38
description:
2025-01-26 13:39:14 dovecot_plain authenticator failed for ([117.211.197.38]) [117.211.197.38]:60262: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-01-26 13:39:26 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:49005: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 26 13:40:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
description:
Jan 26 13:40:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-01-26 13:40:12 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:51561: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-26 13:40:22 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:40220: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-01-26 13:40:24 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (sabings) [80.15.78.70]:35099: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-01-26 13:40:35 dovecot_login authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:50110: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/js/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Jan 26 13:40:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Jan 26 13:40:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 13:40:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 13:40:46 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:31486: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.117
description:
Jan 26 13:41:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
description:
2025-01-26 13:41:02 dovecot_plain authenticator failed for (matrize) [65.20.153.146]:47399: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
description:
2025-01-26 13:41:02 dovecot_login authenticator failed for ([111.61.175.117]) [111.61.175.117]:10474: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.103.187.12
description:
Jan 26 13:40:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.103.187.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.103.187.12
description:
2025-01-26 13:40:43 dovecot_login authenticator failed for ([88.103.187.12]) [88.103.187.12]:60734: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.153.146
description:
Jan 26 13:41:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.153.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/css/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 26 13:40:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-26 13:40:56 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:15833: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 26 13:40:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-26 13:40:44 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it (net-2-32-137-250.cust.dsl.teletu.it) [2.32.137.250]:42144: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
description:
Jan 26 13:42:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.242
description:
Jan 26 13:42:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
description:
2025-01-26 13:42:15 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:40240: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-26 13:42:17 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:43451: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-26 13:42:14 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:51731: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Jan 26 13:42:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-01-26 13:42:26 dovecot_login authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:53199: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-26 13:42:30 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:45889: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
description:
2025-01-26 13:42:35 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:40077: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 13:42:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
description:
2025-01-26 13:42:04 dovecot_plain authenticator failed for ([222.132.167.110]) [222.132.167.110]:38771: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
description:
Jan 26 13:42:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 26 13:42:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.103.231.87
description:
Jan 26 13:41:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.103.231.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.231.87
description:
2025-01-26 13:41:53 dovecot_login authenticator failed for ([59.103.231.87]) [59.103.231.87]:61878: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
description:
2025-01-26 13:42:08 dovecot_login authenticator failed for ([111.61.176.242]) [111.61.176.242]:24292: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Jan 26 13:42:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 26 13:42:32 ait sshd[2260394]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 26 13:42:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-26 13:42:18 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:44346: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 26 13:42:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-26 13:42:24 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:53750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Jan 26 13:42:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-01-26 13:42:32 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:56184: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/js/data1/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 26 13:42:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
description:
Jan 26 13:42:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-01-26 13:42:22 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:56564: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
description:
Jan 26 13:42:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 26 13:42:32 ait sshd[2260394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 26 13:42:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-26 13:42:39 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:55491: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.178
description:
Jan 26 13:43:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Jan 26 13:42:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
description:
Jan 26 13:43:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/js/data1/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.52
description:
Jan 26 13:42:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.52
description:
2025-01-26 13:42:52 dovecot_login authenticator failed for ([103.146.233.52]) [103.146.233.52]:42452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-01-26 13:42:53 dovecot_plain authenticator failed for ([221.13.138.138]) [221.13.138.138]:55238: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Jan 26 13:43:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.178
description:
2025-01-26 13:43:25 dovecot_plain authenticator failed for 83-233-71-178.cust.bredband2.com [83.233.71.178]:56430: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
description:
2025-01-26 13:43:04 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:40843: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-01-26 13:43:17 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:42146: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
description:
2025-01-26 13:43:40 dovecot_plain authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:35062: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/js/engine1/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 26 13:43:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
description:
Jan 26 13:43:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-01-26 13:43:52 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:55146: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
description:
Jan 26 13:44:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 26 13:44:30 ait sshd[2261059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
description:
2025-01-26 13:44:36 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:43142: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
description:
Jan 26 13:43:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-26 13:44:01 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:40635: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
description:
2025-01-26 13:44:03 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:55999: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 26 13:44:30 ait sshd[2261059]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
description:
Jan 26 13:44:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 13:44:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
description:
Jan 26 13:44:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
description:
2025-01-26 13:44:54 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:58544: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/js/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 13:45:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 26 13:44:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-26 13:44:47 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:48996: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-01-26 13:45:12 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:59234: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Jan 26 13:45:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-01-26 13:45:43 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:32996: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 26 13:46:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-26 13:46:25 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:40193: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 26 13:45:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
description:
2025-01-26 13:46:17 dovecot_plain authenticator failed for ([110.189.153.136]) [110.189.153.136]:55311: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
description:
Jan 26 13:45:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-01-26 13:45:51 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:40949: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Jan 26 13:46:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-26 13:45:58 dovecot_plain authenticator failed for (houdae) [217.32.209.51]:44225: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 26 13:46:15 ait sshd[2261954]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 26 13:46:15 ait sshd[2261954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 26 13:47:09 ait sshd[2262216]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 26 13:47:09 ait sshd[2262216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
description:
Jan 26 13:47:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 26 13:47:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-26 13:47:40 dovecot_plain authenticator failed for ([60.213.27.250]) [60.213.27.250]:40981: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.164.64
description:
Jan 26 13:47:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.164.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.164.64
description:
2025-01-26 13:47:59 dovecot_plain authenticator failed for ([190.185.164.64]) [190.185.164.64]:34101: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 13:48:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 13:49:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Jan 26 13:50:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-01-26 13:50:17 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:56610: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.166.13
description:
Jan 26 13:50:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.166.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.166.13
description:
2025-01-26 13:50:27 dovecot_plain authenticator failed for ([92.255.166.13]) [92.255.166.13]:56563: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 26 13:50:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-26 13:50:31 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (kromencele) [83.254.126.238]:60098: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
description:
2025-01-26 13:50:52 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:61754: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
description:
2025-01-26 13:50:54 dovecot_plain authenticator failed for ([14.6.16.137]) [14.6.16.137]:53558: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 26 13:51:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.148.0.56
description:
Jan 26 13:51:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.148.0.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 13:50:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.16.137
description:
Jan 26 13:50:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.6.16.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-26 13:50:43 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:41357: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
description:
Jan 26 13:50:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.22.86
description:
Jan 26 13:51:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.22.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.22.86
description:
2025-01-26 13:51:06 dovecot_plain authenticator failed for ([221.163.22.86]) [221.163.22.86]:51707: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-01-26 13:51:20 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:51282: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 26 13:50:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.148.0.56
description:
2025-01-26 13:51:38 dovecot_plain authenticator failed for 56.sub-166-148-0.myvzw.com [166.148.0.56]:59000: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Jan 26 13:51:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-01-26 13:51:55 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:60919: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Jan 26 13:52:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-01-26 13:52:03 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:41920: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.177.209.66
description:
Jan 26 13:53:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.177.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.177.209.66
description:
2025-01-26 13:53:09 dovecot_plain authenticator failed for ([42.177.209.66]) [42.177.209.66]:35530: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
description:
Jan 26 13:53:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.86.146.178
description:
Jan 26 13:53:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.86.146.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
description:
2025-01-26 13:53:30 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:36032: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.86.146.178
description:
2025-01-26 13:53:31 dovecot_plain authenticator failed for ([112.86.146.178]) [112.86.146.178]:41144: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 26 13:53:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 26 13:53:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-26 13:53:43 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:42426: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-26 13:53:39 dovecot_plain authenticator failed for (porke) [207.188.157.230]:19162: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-26 13:55:00 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:40586: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 26 13:55:01 ait sshd[2265239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.211
description:
Jan 26 13:55:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.211
description:
2025-01-26 13:55:22 dovecot_login authenticator failed for ([195.178.110.211]) [195.178.110.211]:54937: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 26 13:54:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.247.227.109
description:
Jan 26 13:54:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.247.227.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 26 13:55:01 ait sshd[2265239]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.247.227.109
description:
2025-01-26 13:54:48 dovecot_plain authenticator failed for ([223.247.227.109]) [223.247.227.109]:58550: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-26 13:55:41 dovecot_plain authenticator failed for ([218.22.187.70]) [218.22.187.66]:53386: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-26 13:55:52 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:26286: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 26 13:56:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 13:56:17 ait sshd[2266000]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 13:56:17 ait sshd[2266000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.50.125
description:
Jan 26 13:55:41 ait sshd[2265706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.50.125  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
description:
Jan 26 13:56:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
description:
2025-01-26 13:56:17 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:38062: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-26 13:56:13 dovecot_plain authenticator failed for (mintious) [81.211.77.58]:4073: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.34.17.130
description:
Jan 26 13:56:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.34.17.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
description:
2025-01-26 13:56:29 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:55902: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 26 13:55:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.50.125
description:
Jan 26 13:55:41 ait sshd[2265706]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.50.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 26 13:55:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
description:
Jan 26 13:57:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
description:
2025-01-26 13:57:16 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:56558: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 26 13:57:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
description:
2025-01-26 13:57:06 dovecot_plain authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:50390: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-26 13:57:09 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:52336: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 26 13:56:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-26 13:57:35 dovecot_plain authenticator failed for (oxyandae) [207.188.157.230]:44065: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Jan 26 13:57:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-26 13:56:53 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:56624: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 26 13:57:03 ait sshd[2266238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
description:
Jan 26 13:57:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 26 13:57:03 ait sshd[2266238]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-01-26 13:58:11 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:38433: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-26 13:58:20 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net (rhiles) [69.121.199.203]:52020: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 26 13:58:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Jan 26 13:58:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-01-26 13:58:10 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:54170: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 26 13:57:50 ait sshd[2266510]: Invalid user waxmann-verlag.de 2a00 from 111.231.56.128 port 48926


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 13:57:51 ait sshd[2266510]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 26 13:58:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Jan 26 13:58:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
description:
Jan 26 13:58:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-01-26 13:58:36 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:57311: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 13:57:51 ait sshd[2266510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 26 13:58:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-26 13:58:21 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:59904: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-01-26 13:58:51 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:38119: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.222.244.89
description:
Jan 26 13:59:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.222.244.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 26 13:59:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.21.118
description:
2025-01-26 13:58:46 dovecot_plain authenticator failed for (5x16x21x118.static-business.spb.ertelecom.ru) [5.16.21.118]:54460: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.16.21.118
description:
Jan 26 13:58:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.16.21.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
description:
Jan 26 13:58:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 13:58:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.222.244.89
description:
2025-01-26 13:59:03 dovecot_login authenticator failed for (89.244.222.60.adsl-pool.sx.cn) [60.222.244.89]:60911: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-26 13:59:21 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:50454: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
description:
2025-01-26 13:58:37 dovecot_plain authenticator failed for ([45.65.68.104]) [45.65.68.104]:54134: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
description:
Jan 26 13:59:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-01-26 13:59:49 dovecot_login authenticator failed for ([185.113.49.23]) [185.113.49.23]:48635: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Jan 26 14:00:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-01-26 14:00:08 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:33632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 26 14:00:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.84.220
description:
Jan 26 14:00:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.84.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.84.220
description:
2025-01-26 14:00:41 dovecot_plain authenticator failed for ([175.210.84.220]) [175.210.84.220]:60726: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Jan 26 14:00:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.115.119
description:
Jan 26 14:01:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.115.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Jan 26 14:01:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
description:
2025-01-26 14:00:50 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:34329: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
description:
2025-01-26 14:00:52 dovecot_plain authenticator failed for ([41.214.10.178]) [41.214.10.178]:49636: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 26 14:01:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
description:
2025-01-26 14:01:20 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:56009: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Jan 26 14:01:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.115.119
description:
2025-01-26 14:01:12 dovecot_plain authenticator failed for (conata.static.gvt.net.br) [177.43.115.119]:45960: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-26 14:01:17 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:54015: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-26 14:00:38 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:33157: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
description:
Jan 26 14:00:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-01-26 14:01:03 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:45008: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-26 14:01:42 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:50696: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 14:01:46 ait sshd[2268095]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 14:01:46 ait sshd[2268095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.135.18.138
description:
2025-01-26 14:01:57 dovecot_login authenticator failed for ([61.135.18.138]) [61.135.18.138]:35321: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 26 14:01:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.85.183.88
description:
Jan 26 14:02:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.85.183.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.85.183.88
description:
2025-01-26 14:02:02 dovecot_plain authenticator failed for a88.sub183.net78.udm.net (vivocy) [78.85.183.88]:52444: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 26 14:02:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.148.106
description:
Jan 26 14:02:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.148.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-26 14:02:06 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:39710: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.47.199
description:
Jan 26 14:02:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.47.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.47.199
description:
2025-01-26 14:02:12 dovecot_login authenticator failed for 24.115.47.199.res-cmts.hzl3.ptd.net [24.115.47.199]:47555: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 26 14:01:55 ait sshd[2268138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 26 14:01:55 ait sshd[2268138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
description:
2025-01-26 14:02:17 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:34884: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.135.18.138
description:
Jan 26 14:01:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.135.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 14:02:56 ait sshd[2268447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 26 14:02:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-26 14:03:00 dovecot_plain authenticator failed for (deheries) [94.140.210.134]:54881: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Jan 26 14:03:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-01-26 14:03:33 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:58670: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 14:03:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-01-26 14:03:09 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:39924: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
description:
Jan 26 14:03:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-01-26 14:03:20 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:57378: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.233
description:
2025-01-26 14:03:28 dovecot_plain authenticator failed for 111-70-23-233.emome-ip.hinet.net [111.70.23.233]:58029: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 26 14:03:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Jan 26 14:03:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-01-26 14:03:06 dovecot_login authenticator failed for ([112.220.235.237]) [112.220.235.237]:59870: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Jan 26 14:03:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
description:
2025-01-26 14:03:17 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:57222: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 14:02:56 ait sshd[2268447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.229.86
description:
Jan 26 14:03:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.229.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.229.86
description:
2025-01-26 14:03:15 dovecot_plain authenticator failed for ([31.141.229.86]) [31.141.229.86]:38612: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.233
description:
Jan 26 14:03:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Jan 26 14:03:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-26 14:03:33 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:50916: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
description:
Jan 26 14:03:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 26 14:04:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-26 14:04:19 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:54691: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-26 14:04:26 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:42576: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
description:
2025-01-26 14:04:05 dovecot_plain authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:37714: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 26 14:04:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.26.29.114
description:
2025-01-26 14:03:44 dovecot_plain authenticator failed for ipb21a1d72.dynamic.kabel-deutschland.de [178.26.29.114]:59183: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Jan 26 14:03:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.215.241
description:
Jan 26 14:03:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.215.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.215.241
description:
2025-01-26 14:03:49 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:51202: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
description:
Jan 26 14:03:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
description:
2025-01-26 14:03:59 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:37287: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 26 14:03:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-26 14:03:55 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:35902: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.57.125
description:
Jan 26 14:04:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.57.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.26.29.114
description:
Jan 26 14:03:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.26.29.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-01-26 14:03:48 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:35607: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
description:
2025-01-26 14:04:00 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:41892: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Jan 26 14:04:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-01-26 14:04:14 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:43228: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 26 14:04:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.28.86.1
description:
Jan 26 14:05:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.28.86.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-26 14:04:49 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:60344: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
description:
2025-01-26 14:05:27 dovecot_plain authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:59770: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 14:05:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
description:
Jan 26 14:05:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 54.89.58.252
domain: www.lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/notice-wall/.git/config||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-01-26 14:05:38 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:33049: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 26 14:05:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-26 14:05:54 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (mophil) [89.153.62.100]:56004: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 26 14:05:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-26 14:05:58 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (hydriadual) [94.45.76.149]:33622: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
description:
2025-01-26 14:07:26 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:59068: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.195.198
description:
2025-01-26 14:07:32 dovecot_plain authenticator failed for ([221.10.195.198]) [221.10.195.198]:46100: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
description:
Jan 26 14:07:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 14:07:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.195.198
description:
Jan 26 14:07:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Jan 26 14:07:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-01-26 14:07:10 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:40729: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 154.161.182.42
domain: iric.us
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users/me?_fields=capabilities&context=edit&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
description:
Jan 26 14:08:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-01-26 14:08:13 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:53344: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
description:
2025-01-26 14:08:15 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:35190: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
description:
2025-01-26 14:08:22 dovecot_plain authenticator failed for (hebei.2.60.in-addr.arpa) [60.2.203.254]:34969: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.138
description:
Jan 26 14:07:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.138 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 116.118.51.209
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-07.116.118.51.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
description:
Jan 26 14:08:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
description:
Jan 26 14:08:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.2.203.254
description:
Jan 26 14:08:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.2.203.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 14:08:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.138
description:
2025-01-26 14:07:48 dovecot_plain authenticator failed for ([121.202.155.138]) [121.202.155.138]:23295: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.113.9.34
description:
Jan 26 14:07:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.113.9.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.113.9.34
description:
2025-01-26 14:07:51 dovecot_plain authenticator failed for ([111.113.9.34]) [111.113.9.34]:59776: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
description:
Jan 26 14:07:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
description:
2025-01-26 14:08:00 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:51486: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
description:
2025-01-26 14:08:03 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:56952: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 26 14:09:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 221.156.137.103
description:
Jan 26 14:09:25 ait sshd[2271120]: Invalid user universitypublishing from 221.156.137.103 port 33788


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 26 14:09:33 ait sshd[2271195]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-01-26 14:09:06 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:46472: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.90.182
description:
2025-01-26 14:09:22 dovecot_plain authenticator failed for (182.90.156.175.unknown.m1.com.sg) [175.156.90.182]:42199: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-01-26 14:09:33 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:35416: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-26 14:09:28 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:43926: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Jan 26 14:09:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.90.182
description:
Jan 26 14:09:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.90.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 26 14:09:25 ait sshd[2271120]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 26 14:09:25 ait sshd[2271120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Jan 26 14:09:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-01-26 14:09:33 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:33186: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 26 14:09:33 ait sshd[2271195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
description:
Jan 26 14:09:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 14:09:41 ait sshd[2271260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-01-26 14:09:44 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:40583: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-26 14:10:09 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:20780: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 14:10:09 ait sshd[2271499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 26 14:10:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-26 14:09:53 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (unithisma) [94.45.76.149]:41220: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 26 14:10:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-26 14:10:20 dovecot_plain authenticator failed for ([220.178.39.106]) [220.178.39.106]:44224: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 26 14:10:09 ait sshd[2271499]: Invalid user online-marketing-fbc.com 2a00 from 122.51.104.242 port 51642


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 14:10:09 ait sshd[2271499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 14:10:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Jan 26 14:09:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 14:09:41 ait sshd[2271260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 26 14:09:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.66
description:
Jan 26 14:10:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.66
description:
2025-01-26 14:10:17 dovecot_login authenticator failed for ([92.118.39.66]) [92.118.39.66]:59796: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 14:10:55 ait sshd[2272018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.132.50
description:
[2025-01-26 14:11:02 +0100] info [webmaild] 179.127.132.50 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.200.247
description:
2025-01-26 14:11:07 dovecot_plain authenticator failed for ([120.234.200.247]) [120.234.200.247]:33749: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.200
description:
2025-01-26 14:11:30 dovecot_plain authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:48332: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 26 14:10:55 ait sshd[2272018]: Invalid user online-marketing-fbc.com 2a00 from 122.51.104.242 port 39688


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 14:10:55 ait sshd[2272018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.200.247
description:
Jan 26 14:11:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.200.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.201.148.0
description:
[2025-01-26 14:11:07 +0100] info [webmaild] 187.201.148.0 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
description:
2025-01-26 14:11:19 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:60678: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
description:
Jan 26 14:11:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.103.200
description:
Jan 26 14:11:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.103.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 26 14:10:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-26 14:10:55 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:41266: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-01-26 14:12:22 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:55964: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 26 14:11:43 ait sshd[2272356]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 26 14:11:43 ait sshd[2272356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.52.89.218
description:
2025-01-26 14:11:56 dovecot_plain authenticator failed for ([84.52.89.218]) [84.52.89.218]:39588: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.51.28.60
description:
2025-01-26 14:12:01 dovecot_plain authenticator failed for (123-51-28-60.static.dsl.net.au) [123.51.28.60]:57294: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-01-26 14:12:05 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:57514: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Jan 26 14:12:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.52.89.218
description:
Jan 26 14:11:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.52.89.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.51.28.60
description:
Jan 26 14:11:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.51.28.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 26 14:12:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.85.163
description:
Jan 26 14:12:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.201.85.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-01-26 14:12:17 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:35274: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.136.239
description:
Jan 26 14:12:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.136.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.85.163
description:
2025-01-26 14:12:15 dovecot_plain authenticator failed for ([87.201.85.163]) [87.201.85.163]:34519: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Jan 26 14:12:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Jan 26 14:12:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.136.239
description:
2025-01-26 14:12:29 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.136.239]:20593: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 26 14:11:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-26 14:11:51 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:57033: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Jan 26 14:12:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-01-26 14:12:10 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:57454: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-26 14:12:11 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:57819: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 14:13:03 ait sshd[2272747]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 14:13:03 ait sshd[2272747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-01-26 14:13:24 dovecot_plain authenticator failed for ([59.97.139.38]) [59.97.139.38]:55700: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 26 14:13:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-26 14:13:33 dovecot_plain authenticator failed for ([5.159.173.105]) [5.159.173.105]:35696: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Jan 26 14:13:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 26 14:13:37 ait sshd[2272972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.97
description:
Jan 26 14:14:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.182
description:
Jan 26 14:14:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-26 14:14:32 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:49026: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.81
description:
2025-01-26 14:14:29 dovecot_login authenticator failed for ([193.32.162.81]) [193.32.162.81]:60773: 535 Incorrect authentication data (set_id=fax)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.66
description:
2025-01-26 14:14:12 dovecot_login authenticator failed for ([193.32.162.66]) [193.32.162.66]:49354: 535 Incorrect authentication data (set_id=backup)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.73
description:
Jan 26 14:14:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.83
description:
2025-01-26 14:14:22 dovecot_login authenticator failed for ([193.32.162.83]) [193.32.162.83]:52457: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.81
description:
Jan 26 14:14:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.212.191.63
description:
[2025-01-26 14:14:22 +0100] info [webmaild] 102.212.191.63 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 26 14:14:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.66
description:
Jan 26 14:14:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.97
description:
2025-01-26 14:14:11 dovecot_login authenticator failed for ([193.32.162.97]) [193.32.162.97]:51434: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.73
description:
2025-01-26 14:14:17 dovecot_login authenticator failed for ([193.32.162.73]) [193.32.162.73]:55556: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
description:
2025-01-26 14:14:19 dovecot_login authenticator failed for ([112.31.93.182]) [112.31.93.182]:52487: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.83
description:
Jan 26 14:14:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 26 14:15:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
description:
Jan 26 14:15:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-26 14:15:25 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:57135: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Jan 26 14:15:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-01-26 14:15:32 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:30644: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 26 14:15:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Jan 26 14:15:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-26 14:15:15 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:48712: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-26 14:15:35 dovecot_plain authenticator failed for ([89.211.42.163]) [37.186.40.110]:38672: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-26 14:15:05 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:35695: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-01-26 14:15:26 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl [62.238.192.121]:34178: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.122.255.48
description:
[2025-01-26 14:14:42 +0100] info [webmaild] 103.122.255.48 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 26 14:15:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.72.5.218
description:
Jan 26 14:16:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.72.5.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.5.218
description:
2025-01-26 14:16:35 dovecot_plain authenticator failed for ([192.72.5.218]) [192.72.5.218]:41226: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Jan 26 14:16:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 14:15:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 14:15:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (undebretsh) [87.103.126.54]:32052: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
description:
Jan 26 14:16:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
description:
2025-01-26 14:16:12 dovecot_plain authenticator failed for ([103.170.225.80]) [103.170.225.80]:50126: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 26 14:17:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-01-26 14:16:47 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:45040: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 14:16:49 ait sshd[2274301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
description:
2025-01-26 14:16:50 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:42346: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.226.205
description:
[2025-01-26 14:17:29 +0100] info [webmaild] 45.6.226.205 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-01-26 14:16:38 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:49338: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 14:16:49 ait sshd[2274301]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.51.28.60
description:
Jan 26 14:17:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.51.28.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.51.28.60
description:
2025-01-26 14:17:10 dovecot_plain authenticator failed for (123-51-28-60.static.dsl.net.au) [123.51.28.60]:43628: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-26 14:17:30 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:56916: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Jan 26 14:16:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
description:
Jan 26 14:16:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.89.21
description:
[2025-01-26 14:17:06 +0100] info [webmaild] 45.160.89.21 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 26 14:18:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-26 14:18:16 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:34745: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 26 14:18:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Jan 26 14:17:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.107.198
description:
2025-01-26 14:17:47 dovecot_plain authenticator failed for ([187.92.178.105]) [187.8.107.198]:58113: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-26 14:18:03 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:50532: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 14:18:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 26 14:18:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-01-26 14:17:40 dovecot_plain authenticator failed for ([31.41.81.24]) [31.41.81.24]:48525: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.107.198
description:
Jan 26 14:17:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.107.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
description:
Jan 26 14:17:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-01-26 14:17:51 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:53644: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 14:19:19 ait sshd[2275177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-26 14:19:33 dovecot_plain authenticator failed for (divers) [46.30.161.197]:50268: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.210.94.61
description:
Jan 26 14:18:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.210.94.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-26 14:18:55 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:44874: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 26 14:19:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-26 14:19:12 dovecot_login authenticator failed for ([223.26.225.129]) [210.206.24.234]:55120: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-26 14:19:26 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:58712: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 26 14:18:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Jan 26 14:19:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 26 14:19:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 26 14:19:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
description:
2025-01-26 14:18:55 dovecot_plain authenticator failed for ([46.210.94.61]) [46.210.94.61]:52506: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Jan 26 14:19:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 26 14:19:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 14:19:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-26 14:19:06 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:45418: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-01-26 14:19:13 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:45355: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-26 14:19:14 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:50238: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 14:19:19 ait sshd[2275177]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-26 14:18:39 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:24960: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 26 14:19:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-01-26 14:19:04 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:22967: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 26 14:19:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.212
description:
Jan 26 14:19:45 ait sshd[2275369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-26 14:20:01 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com (putogly) [131.106.31.52]:50980: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.212
description:
Jan 26 14:20:06 ait sshd[2275369]: error: maximum authentication attempts exceeded for root from 218.92.0.212 port 36118 ssh2 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 26 14:20:24 ait sshd[2275661]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 26 14:20:24 ait sshd[2275661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
description:
Jan 26 14:19:45 ait sshd[2275369]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 26 14:19:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 26 14:21:13 ait sshd[2276162]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
description:
2025-01-26 14:21:18 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:57936: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 26 14:21:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 26 14:20:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-26 14:20:52 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:2446: 535 Incorrect authentication data (set_id=edonkor)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.187.180.3
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/wpr-addons/forms/b1ack.php||SC:/home/ait02/public_html/wp-content/uploads/wpr-addons


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 89.187.180.3
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:14-21.89.187.180.3||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 26 14:21:13 ait sshd[2276162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
description:
Jan 26 14:21:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.168.194
description:
Jan 26 14:20:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.168.194
description:
2025-01-26 14:20:41 dovecot_plain authenticator failed for ([65.76.168.194]) [65.76.168.194]:50204: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-26 14:21:38 dovecot_plain authenticator failed for ([218.22.187.68]) [218.22.187.66]:49623: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 26 14:21:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 26 14:21:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.51.242.119
description:
Jan 26 14:22:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.51.242.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
description:
Jan 26 14:22:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-26 14:22:18 dovecot_plain authenticator failed for (subrot) [102.53.15.54]:40750: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-26 14:21:53 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:50073: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.242.119
description:
2025-01-26 14:22:14 dovecot_login authenticator failed for (85.99.244.58.adsl-pool.jlccptt.net.cn) [119.51.242.119]:57484: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 26 14:22:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
description:
2025-01-26 14:22:16 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:51306: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Jan 26 14:22:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-26 14:21:42 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:40504: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-01-26 14:22:25 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:50566: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 26 14:22:39 ait sshd[2276665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 26 14:22:39 ait sshd[2276665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Jan 26 14:23:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.102.91
description:
[2025-01-26 14:23:27 +0100] info [webmaild] 213.230.102.91 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 26 14:23:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.129.180
description:
Jan 26 14:22:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.129.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.193.83
description:
2025-01-26 14:22:52 dovecot_login authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:56260: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 14:23:07 ait sshd[2276726]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Jan 26 14:23:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-01-26 14:23:23 dovecot_plain authenticator failed for ([50.224.22.135]) [50.224.22.135]:48396: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.198.37.128
description:
2025-01-26 14:22:59 dovecot_plain authenticator failed for ([116.198.37.128]) [116.198.37.128]:43478: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 14:23:07 ait sshd[2276726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.129.180
description:
2025-01-26 14:22:47 dovecot_login authenticator failed for ([178.70.129.180]) [178.70.129.180]:38766: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.193.83
description:
Jan 26 14:22:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.193.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.198.37.128
description:
Jan 26 14:22:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.198.37.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-26 14:23:10 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:38838: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.111.241.203
description:
[2025-01-26 14:23:23 +0100] info [webmaild] 190.111.241.203 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-26 14:23:34 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:53852: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-26 14:24:16 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:43270: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 26 14:24:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.174.208
description:
Jan 26 14:23:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.174.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 26 14:23:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-01-26 14:24:06 dovecot_plain authenticator failed for ([31.207.252.124]) [31.207.252.124]:32875: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.38.203
description:
Jan 26 14:24:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.38.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-26 14:24:28 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:18895: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.174.208
description:
2025-01-26 14:23:49 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.174.208]:2822: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-01-26 14:23:53 dovecot_login authenticator failed for ([72.26.178.196]) [72.26.178.196]:53726: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
description:
Jan 26 14:23:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-01-26 14:24:05 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:34844: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Jan 26 14:24:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-01-26 14:24:18 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:52887: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-01-26 14:24:00 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:50837: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Jan 26 14:24:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.38.203
description:
2025-01-26 14:24:12 dovecot_plain authenticator failed for ([112.27.38.203]) [112.27.38.203]:38973: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 26 14:24:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Jan 26 14:24:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Jan 26 14:24:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-01-26 14:25:07 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:40920: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
description:
Jan 26 14:25:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
description:
2025-01-26 14:25:27 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:38388: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-01-26 14:24:43 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:42056: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-26 14:24:57 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:13059: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-26 14:24:58 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:40192: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Jan 26 14:25:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 26 14:24:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Jan 26 14:24:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 26 14:24:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-01-26 14:24:55 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:59064: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-01-26 14:25:05 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:44969: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.76.67.166
description:
[2025-01-26 14:25:37 +0100] info [webmaild] 105.76.67.166 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
description:
Jan 26 14:24:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 14:24:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Jan 26 14:25:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
description:
2025-01-26 14:24:43 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:46453: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
description:
Jan 26 14:26:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 26 14:26:25 ait sshd[2278164]: Invalid user waxmann-verlag.de 2a00 from 111.231.56.128 port 41512


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 14:26:25 ait sshd[2278164]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Jan 26 14:25:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-26 14:25:51 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:34550: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 184.168.121.83
description:
Jan 26 14:25:53 ait sshd[2278084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.121.83


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 14:26:25 ait sshd[2278164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-01-26 14:25:45 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:47201: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.246.251
description:
Jan 26 14:26:34 ait sshd[2278300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.246.251


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.246.251
description:
Jan 26 14:26:34 ait sshd[2278300]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.246.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-01-26 14:26:05 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:57134: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 26 14:26:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.168.121.83
description:
Jan 26 14:25:53 ait sshd[2278084]: pam_imunify(sshd:auth): [IM360_RBL] The IP 184.168.121.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 14:26:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 26 14:25:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 26 14:25:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-26 14:25:54 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:58872: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-26 14:26:34 dovecot_plain authenticator failed for ([37.57.69.227]) [37.57.69.227]:47097: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.80
description:
2025-01-26 14:26:38 dovecot_login authenticator failed for (80.20.167.124.adsl-pool.sx.cn) [124.167.20.80]:51739: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.167.233.146
description:
[2025-01-26 14:25:45 +0100] info [webmaild] 103.167.233.146 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-01-26 14:25:54 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:45020: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-01-26 14:25:51 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:39925: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Jan 26 14:26:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Jan 26 14:25:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
description:
2025-01-26 14:26:03 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:47136: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Jan 26 14:25:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Jan 26 14:26:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
description:
2025-01-26 14:27:12 dovecot_plain authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:57532: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.148.106
description:
Jan 26 14:26:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.148.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.93.229.230
description:
Jan 26 14:26:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.93.229.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.93.229.230
description:
2025-01-26 14:26:55 dovecot_plain authenticator failed for ([218.93.229.230]) [218.93.229.230]:59281: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
description:
Jan 26 14:27:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 14:27:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.72.246.251
description:
Jan 26 14:26:38 ait sshd[2278300]: Disconnected from invalid user es 148.72.246.251 port 59744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
description:
2025-01-26 14:26:50 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:52476: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-01-26 14:26:53 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:37384: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.234.219
description:
Jan 26 14:27:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.234.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.194.116
description:
Jan 26 14:27:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.194.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.194.116
description:
2025-01-26 14:27:44 dovecot_plain authenticator failed for ([120.234.194.116]) [120.234.194.116]:44049: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.122.4.232
description:
[2025-01-26 14:28:02 +0100] info [webmaild] 62.122.4.232 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.216
description:
2025-01-26 14:28:32 dovecot_login authenticator failed for ([195.178.110.216]) [195.178.110.216]:53883: 535 Incorrect authentication data (set_id=scanner)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Jan 26 14:28:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Jan 26 14:28:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-01-26 14:28:32 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:54338: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
description:
2025-01-26 14:28:29 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:54953: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-26 14:28:15 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:60317: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-01-26 14:28:23 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:51401: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-26 14:28:27 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:47028: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.42.235.92
description:
Jan 26 14:28:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.42.235.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.42.235.92
description:
2025-01-26 14:28:05 dovecot_plain authenticator failed for s92-235-42-8.bcec.tx.wi-power.com [8.42.235.92]:52125: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 26 14:28:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.128.3.159
description:
[2025-01-26 14:28:21 +0100] info [webmaild] 196.128.3.159 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 26 14:28:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
description:
Jan 26 14:28:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.216
description:
Jan 26 14:28:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.81.93
description:
2025-01-26 14:28:56 dovecot_plain authenticator failed for ([14.48.81.93]) [14.48.81.93]:33246: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.196.189
description:
2025-01-26 14:29:14 dovecot_plain authenticator failed for ([120.234.196.189]) [120.234.196.189]:56079: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.214.226
description:
2025-01-26 14:29:30 dovecot_plain authenticator failed for (broadband.actcorp.in) [115.245.214.226]:53580: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.233.196
description:
Jan 26 14:28:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.233.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.81.93
description:
Jan 26 14:28:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.81.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.196.189
description:
Jan 26 14:29:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.196.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.233.196
description:
2025-01-26 14:28:43 dovecot_plain authenticator failed for p46196-obmd01.osaka.ocn.ne.jp [153.141.233.196]:44486: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.211.125
description:
Jan 26 14:29:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.211.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.215
description:
Jan 26 14:29:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.53.85.222
description:
Jan 26 14:28:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.53.85.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.227.80
description:
Jan 26 14:29:04 ait sshd[2279401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.130.227.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.64.191
description:
Jan 26 14:29:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.64.191 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.130.227.80
description:
Jan 26 14:29:04 ait sshd[2279401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.130.227.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.211.125
description:
2025-01-26 14:29:05 dovecot_plain authenticator failed for ([113.64.211.125]) [113.64.211.125]:56161: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.69.200
description:
2025-01-26 14:28:52 dovecot_plain authenticator failed for ([178.232.69.200]) [178.232.69.200]:32820: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-01-26 14:29:02 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:48628: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.69.200
description:
Jan 26 14:28:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.69.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Jan 26 14:28:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.215
description:
2025-01-26 14:29:12 dovecot_login authenticator failed for ([195.178.110.215]) [195.178.110.215]:57991: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
description:
Jan 26 14:29:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.53.85.222
description:
2025-01-26 14:28:39 dovecot_plain authenticator failed for itau-g2-0-2-150618-iacc01.rce.embratel.net.br [189.53.85.222]:54068: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-01-26 14:28:52 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:38696: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
description:
Jan 26 14:29:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.135.18.138
description:
Jan 26 14:29:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.135.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
description:
2025-01-26 14:29:54 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:48140: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 26 14:30:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 14:30:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.168.121.83
description:
Jan 26 14:30:29 ait sshd[2279972]: pam_imunify(sshd:auth): [IM360_RBL] The IP 184.168.121.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 184.168.121.83
description:
Jan 26 14:30:29 ait sshd[2279972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.121.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
description:
2025-01-26 14:29:37 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:45968: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.135.18.138
description:
2025-01-26 14:29:51 dovecot_login authenticator failed for ([61.135.18.138]) [61.135.18.138]:49398: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-26 14:30:04 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:35030: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
description:
Jan 26 14:29:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-01-26 14:31:13 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:51199: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.246.251
description:
Jan 26 14:30:45 ait sshd[2280299]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.246.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.246.251
description:
Jan 26 14:30:45 ait sshd[2280299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.246.251


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
description:
Jan 26 14:31:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
description:
Jan 26 14:30:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.0.78.32
description:
2025-01-26 14:30:59 dovecot_plain authenticator failed for fl-71-0-78-32.dhcp.embarqhsd.net [71.0.78.32]:44876: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.8.247.41
description:
[2025-01-26 14:31:28 +0100] info [webmaild] 31.8.247.41 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.0.78.32
description:
Jan 26 14:30:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.0.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
description:
2025-01-26 14:30:59 dovecot_login authenticator failed for ([223.100.248.64]) [223.100.248.64]:35750: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
description:
Jan 26 14:31:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
description:
2025-01-26 14:31:16 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:39832: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
description:
2025-01-26 14:31:56 dovecot_plain authenticator failed for ([103.158.138.179]) [103.158.138.179]:60096: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.168.121.83
description:
Jan 26 14:31:58 ait sshd[2280661]: Failed password for invalid user test from 184.168.121.83 port 49384 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.168.121.83
description:
Jan 26 14:31:56 ait sshd[2280661]: pam_imunify(sshd:auth): [IM360_RBL] The IP 184.168.121.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 184.168.121.83
description:
Jan 26 14:31:56 ait sshd[2280661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.168.121.83


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.246.251
description:
Jan 26 14:32:17 ait sshd[2280801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.246.251


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 14:32:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77350583
name: IM360 WAF: Scan attempt by claudebot crawler
abuser: 3.144.251.106
domain: admissions.ait.edu.gh
description:
IM360 WAF: Scan attempt by claudebot crawler||UA:Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.158.138.179
description:
Jan 26 14:31:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.158.138.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 26 14:32:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-26 14:32:11 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (falned) [83.254.126.238]:43442: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.191.234
description:
[2025-01-26 14:31:38 +0100] info [webmaild] 143.0.191.234 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.246.251
description:
Jan 26 14:32:17 ait sshd[2280801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.246.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Jan 26 14:32:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-01-26 14:32:30 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:55220: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.118.205
description:
[2025-01-26 14:33:28 +0100] info [webmaild] 213.230.118.205 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.162.142
description:
Jan 26 14:32:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.162.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-26 14:33:06 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:57329: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Jan 26 14:33:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-26 14:33:26 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:39566: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 26 14:32:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-01-26 14:33:03 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:57912: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-01-26 14:32:47 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:59908: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 26 14:33:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 26 14:33:09 ait sshd[2281107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-26 14:33:07 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:60865: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Jan 26 14:33:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-01-26 14:33:11 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:56410: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-26 14:33:12 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:56408: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 26 14:33:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 26 14:32:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-26 14:32:56 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:37112: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 26 14:32:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 26 14:33:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 26 14:33:09 ait sshd[2281107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.162.142
description:
2025-01-26 14:32:45 dovecot_plain authenticator failed for 142.162.246.94.ip4.artcom.pl (sated) [94.246.162.142]:37462: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Jan 26 14:32:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-26 14:32:49 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:51708: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-26 14:32:59 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:54347: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.76.101.162
description:
[2025-01-26 14:33:41 +0100] info [webmaild] 41.76.101.162 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 26 14:33:53 ait sshd[2281390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 26 14:33:53 ait sshd[2281390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
description:
Jan 26 14:35:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
description:
2025-01-26 14:35:31 dovecot_plain authenticator failed for ([222.174.142.78]) [222.174.142.78]:6984: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
description:
2025-01-26 14:35:34 dovecot_plain authenticator failed for ([95.79.57.221]) [95.79.57.221]:59962: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 26 14:35:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-26 14:35:15 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:58890: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.174.142.78
description:
Jan 26 14:35:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.174.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 26 14:35:56 ait sshd[2282319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
description:
2025-01-26 14:36:11 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (corphicum) [5.228.154.62]:42726: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 26 14:35:56 ait sshd[2282319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.109.49.203
description:
[2025-01-26 14:35:49 +0100] info [webmaild] 213.109.49.203 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
description:
Jan 26 14:36:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.35.39.82
description:
[2025-01-26 14:36:11 +0100] info [webmaild] 187.35.39.82 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 26 14:35:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-26 14:35:45 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:40931: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.206.200.157
description:
[2025-01-26 14:38:11 +0100] info [webmaild] 185.206.200.157 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-26 14:38:17 dovecot_login authenticator failed for ([103.190.91.113]) [103.190.91.113]:44979: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Jan 26 14:38:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 26 14:38:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 14:38:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Jan 26 14:37:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.214
description:
Jan 26 14:38:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-26 14:38:03 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:64267: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.111
description:
Jan 26 14:38:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.111
description:
2025-01-26 14:38:22 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:50564: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 26 14:37:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-26 14:37:43 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:35034: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.145.175
description:
[2025-01-26 14:37:48 +0100] info [webmaild] 179.189.145.175 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-01-26 14:37:56 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:45046: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 26 14:38:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-26 14:38:31 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:35905: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-26 14:38:55 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:58963: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 14:39:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-01-26 14:38:38 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:39156: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 26 14:38:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-26 14:38:42 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:49604: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 26 14:38:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.16.230
description:
2025-01-26 14:40:28 dovecot_plain authenticator failed for 111-70-16-230.emome-ip.hinet.net [111.70.16.230]:46013: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
description:
Jan 26 14:40:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
description:
2025-01-26 14:40:12 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:41480: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 26 14:40:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.76.29
description:
Jan 26 14:40:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.76.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-26 14:40:23 dovecot_plain authenticator failed for (tropiter) [62.231.31.86]:33981: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.16.230
description:
Jan 26 14:40:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.16.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-01-26 14:41:21 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:12469: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.161.26
description:
Jan 26 14:41:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.161.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.161.123
description:
Jan 26 14:40:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.161.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.161.123
description:
2025-01-26 14:40:39 dovecot_plain authenticator failed for ([93.182.161.123]) [93.182.161.123]:40922: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 26 14:40:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.217
description:
Jan 26 14:41:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.217
description:
2025-01-26 14:41:08 dovecot_login authenticator failed for ([195.178.110.217]) [195.178.110.217]:57654: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.113.91.98
description:
Jan 26 14:40:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.113.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.113.91.98
description:
2025-01-26 14:40:52 dovecot_plain authenticator failed for ([223.113.91.98]) [223.113.91.98]:36246: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Jan 26 14:41:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.161.26
description:
2025-01-26 14:41:32 dovecot_plain authenticator failed for ([223.95.161.26]) [223.95.161.26]:41194: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.212
description:
Jan 26 14:41:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.212
description:
2025-01-26 14:41:59 dovecot_login authenticator failed for ([195.178.110.212]) [195.178.110.212]:64570: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.31.251
description:
Jan 26 14:42:10 ait sshd[2284808]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.247.31.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.247.31.251
description:
Jan 26 14:42:10 ait sshd[2284808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.31.251


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
description:
2025-01-26 14:42:48 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:53558: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 26 14:42:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-26 14:43:09 dovecot_plain authenticator failed for (tross) [217.32.209.51]:39311: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
description:
Jan 26 14:42:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-26 14:42:59 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:60638: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 26 14:43:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 26 14:44:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.64.208.83
description:
Jan 26 14:44:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.64.208.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.64.208.83
description:
2025-01-26 14:44:15 dovecot_login authenticator failed for ([185.64.208.83]) [185.64.208.83]:53926: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 26 14:44:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
description:
2025-01-26 14:44:19 dovecot_login authenticator failed for ([220.124.240.66]) [220.124.240.66]:59498: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 26 14:44:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.80.201
description:
2025-01-26 14:44:03 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:32928: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-26 14:44:29 dovecot_plain authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:52458: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 26 14:44:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-26 14:44:36 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:34923: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 26 14:45:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-26 14:45:26 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:57673: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.238
description:
2025-01-26 14:45:27 dovecot_plain authenticator failed for ([221.195.208.238]) [221.195.208.238]:33558: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.164.235.208
description:
Jan 26 14:45:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.164.235.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
description:
Jan 26 14:45:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 26 14:45:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.238
description:
Jan 26 14:45:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.34.230.4
description:
2025-01-26 14:45:30 dovecot_plain authenticator failed for ([118.34.230.4]) [118.34.230.4]:37357: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.164.235.208
description:
2025-01-26 14:45:33 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:51540: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Jan 26 14:44:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-01-26 14:44:42 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:54920: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.247.31.251
description:
Jan 26 14:44:57 ait sshd[2285721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.31.251


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 26 14:45:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-26 14:45:13 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:33927: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.34.230.4
description:
Jan 26 14:45:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.34.230.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.31.251
description:
Jan 26 14:44:57 ait sshd[2285721]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.247.31.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-26 14:45:21 dovecot_plain authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:57181: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.81
description:
[2025-01-26 14:45:51 +0100] info [cpaneld] 104.207.44.81 - ads17a00060y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads17a00060y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.33.52
description:
[2025-01-26 14:45:54 +0100] info [cpaneld] 104.207.33.52 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.81
description:
[2025-01-26 14:45:56 +0100] info [cpaneld] 156.228.112.81 - ads17a00060y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads17a00060y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.79
description:
[2025-01-26 14:46:22 +0100] info [whostmgrd] 104.207.61.79 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.132
description:
[2025-01-26 14:46:23 +0100] info [whostmgrd] 156.228.109.132 - ads21b00206y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.31
description:
[2025-01-26 14:46:19 +0100] info [cpaneld] 104.207.42.31 - ads21b00206y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00206y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 26 14:45:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-26 14:45:47 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:41592: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.123
description:
[2025-01-26 14:45:56 +0100] info [cpaneld] 104.207.55.123 - ads17a00060y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads17a00060y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.209
description:
[2025-01-26 14:45:57 +0100] info [whostmgrd] 104.207.40.209 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
description:
2025-01-26 14:45:58 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:48826: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-26 14:46:15 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:41010: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.52
description:
[2025-01-26 14:46:20 +0100] info [cpaneld] 104.207.52.52 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.25
description:
[2025-01-26 14:46:24 +0100] info [whostmgrd] 156.228.116.25 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.247.195
description:
Jan 26 14:46:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.247.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.247.31.251
description:
Jan 26 14:46:32 ait sshd[2286570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.31.251


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.247.31.251
description:
Jan 26 14:46:34 ait sshd[2286570]: Failed password for invalid user git from 49.247.31.251 port 43439 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.170.6
description:
2025-01-26 14:45:47 dovecot_plain authenticator failed for ([125.139.170.6]) [125.139.170.6]:36078: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.41
description:
[2025-01-26 14:45:54 +0100] info [cpaneld] 104.207.58.41 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-01-26 14:45:57 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:54012: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.189
description:
[2025-01-26 14:45:58 +0100] info [whostmgrd] 104.207.36.189 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 14:46:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.31.251
description:
Jan 26 14:46:32 ait sshd[2286570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.247.31.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.170.6
description:
Jan 26 14:45:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.170.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.151
description:
[2025-01-26 14:46:00 +0100] info [whostmgrd] 156.228.99.151 - ads17a00060y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.36
description:
[2025-01-26 14:46:20 +0100] info [cpaneld] 156.228.111.36 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-01-26 14:45:39 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:40118: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Jan 26 14:45:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
description:
Jan 26 14:45:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.253
description:
[2025-01-26 14:46:24 +0100] info [whostmgrd] 104.207.40.253 - ads21b00206y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.58
description:
[2025-01-26 14:46:24 +0100] info [whostmgrd] 156.228.83.58 - ads21b00206y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
description:
2025-01-26 14:46:32 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:52650: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.76.124
description:
[2025-01-26 14:46:22 +0100] info [cpaneld] 156.228.76.124 - ads21b00206y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00206y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 26 14:45:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
description:
2025-01-26 14:45:39 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:51754: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.231
description:
[2025-01-26 14:45:57 +0100] info [whostmgrd] 104.207.39.231 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.57
description:
[2025-01-26 14:45:57 +0100] info [whostmgrd] 156.228.114.57 - ads17a00060y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.197
description:
[2025-01-26 14:46:00 +0100] info [whostmgrd] 104.207.36.197 - ads17a00060y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 26 14:46:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.140
description:
[2025-01-26 14:46:21 +0100] info [cpaneld] 156.228.106.140 - ads21b00206y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00206y (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 26 14:45:48 ait sshd[2286125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.33
description:
[2025-01-26 14:46:23 +0100] info [whostmgrd] 104.207.49.33 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.247.195
description:
2025-01-26 14:46:28 dovecot_plain authenticator failed for ([46.138.247.195]) [46.138.247.195]:50534: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
description:
Jan 26 14:46:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.81
description:
[2025-01-26 14:47:20 +0100] info [cpaneld] 156.228.101.81 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.220
description:
[2025-01-26 14:47:20 +0100] info [cpaneld] 104.207.47.220 - ads21b00202y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00202y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.81
description:
[2025-01-26 14:47:21 +0100] info [whostmgrd] 156.228.98.81 - ads21b00202y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 26 14:46:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-01-26 14:46:46 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:40033: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.162
description:
[2025-01-26 14:47:23 +0100] info [whostmgrd] 156.228.93.162 - ads21b00202y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.240
description:
[2025-01-26 14:47:23 +0100] info [whostmgrd] 156.228.102.240 - ads21b00202y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.78.139
description:
[2025-01-26 14:47:00 +0100] info [webmaild] 84.54.78.139 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.170
description:
[2025-01-26 14:47:22 +0100] info [whostmgrd] 104.207.50.170 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Jan 26 14:46:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.245.154
description:
[2025-01-26 14:46:56 +0100] info [webmaild] 177.38.245.154 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.88
description:
[2025-01-26 14:47:18 +0100] info [cpaneld] 156.228.85.88 - ads21b00202y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00202y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.39
description:
[2025-01-26 14:47:19 +0100] info [cpaneld] 104.207.50.39 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.68
description:
[2025-01-26 14:47:21 +0100] info [cpaneld] 104.207.32.68 - ads21b00202y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00202y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.238
description:
[2025-01-26 14:47:21 +0100] info [whostmgrd] 104.207.40.238 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.1
description:
[2025-01-26 14:47:22 +0100] info [whostmgrd] 104.207.39.1 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 26 14:47:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-01-26 14:48:04 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:49936: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-01-26 14:48:15 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:35337: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.214.18
description:
[2025-01-26 14:48:33 +0100] info [webmaild] 37.238.214.18 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Jan 26 14:48:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Jan 26 14:48:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.61.240.239
description:
[2025-01-26 14:48:24 +0100] info [webmaild] 103.61.240.239 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
description:
2025-01-26 14:49:17 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:40676: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.27
description:
2025-01-26 14:49:27 dovecot_plain authenticator failed for 111-70-48-27.emome-ip.hinet.net [111.70.48.27]:50777: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 26 14:48:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-26 14:48:46 dovecot_plain authenticator failed for (troutment) [178.250.191.189]:54452: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
description:
2025-01-26 14:48:59 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:55205: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-26 14:49:11 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:13370: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
description:
Jan 26 14:48:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 26 14:49:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
description:
Jan 26 14:49:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.48.27
description:
Jan 26 14:49:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.48.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Jan 26 14:50:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-01-26 14:50:23 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:2109: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.237.171.228
description:
2025-01-26 14:49:50 dovecot_login authenticator failed for ec2-34-237-171-228.compute-1.amazonaws.com (ait.edu.gh) [34.237.171.228]:51004: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-26 14:49:59 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:37400: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.129.180
description:
2025-01-26 14:50:03 dovecot_plain authenticator failed for ([178.70.129.180]) [178.70.129.180]:47688: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Jan 26 14:50:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Jan 26 14:50:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 26 14:49:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
description:
Jan 26 14:49:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-01-26 14:49:59 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:49862: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.129.180
description:
Jan 26 14:50:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.129.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-26 14:49:48 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:35914: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 26 14:49:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
description:
2025-01-26 14:50:00 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:51356: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-01-26 14:50:12 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:37261: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.237.171.228
description:
Jan 26 14:49:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.237.171.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
description:
Jan 26 14:49:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-01-26 14:50:08 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:43196: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-26 14:51:07 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:23879: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
description:
Jan 26 14:51:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
description:
2025-01-26 14:51:14 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:57130: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-26 14:51:18 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:60708: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 26 14:51:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.84.158
description:
[2025-01-26 14:51:28 +0100] info [webmaild] 45.160.84.158 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
description:
2025-01-26 14:51:02 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:41022: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-51.65.0.27.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-26 14:51:36 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:39629: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 26 14:51:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 26 14:51:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 26 14:51:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-26 14:51:39 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:52812: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Jan 26 14:51:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Jan 26 14:52:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-01-26 14:52:05 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:36046: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.177.34
description:
2025-01-26 14:52:06 dovecot_plain authenticator failed for ([183.233.177.34]) [183.233.177.34]:50097: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
description:
2025-01-26 14:52:26 dovecot_plain authenticator failed for ([74.203.86.207]) [74.203.86.207]:53589: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-01-26 14:51:54 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:50572: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.177.34
description:
Jan 26 14:52:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.177.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.203.86.207
description:
Jan 26 14:52:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.203.86.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 26 14:52:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-26 14:52:37 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:59271: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.89.143.234
description:
2025-01-26 14:53:06 dovecot_plain authenticator failed for ([222.89.143.234]) [222.89.143.234]:55808: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Jan 26 14:53:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 26 14:53:18 ait sshd[2289421]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Jan 26 14:53:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
description:
2025-01-26 14:53:18 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:42743: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.218
description:
[2025-01-26 14:52:57 +0100] info [cpaneld] 156.228.101.218 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00014y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-01-26 14:53:08 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:34020: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.202
description:
[2025-01-26 14:53:02 +0100] info [whostmgrd] 104.207.44.202 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.53
description:
[2025-01-26 14:53:02 +0100] info [whostmgrd] 104.207.45.53 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
description:
Jan 26 14:52:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.76.124
description:
[2025-01-26 14:52:54 +0100] info [cpaneld] 156.228.76.124 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00014y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.188.226
description:
Jan 26 14:53:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.188.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.188.226
description:
2025-01-26 14:53:05 dovecot_plain authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:37978: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
description:
Jan 26 14:53:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 26 14:53:18 ait sshd[2289421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.119
description:
[2025-01-26 14:53:05 +0100] info [whostmgrd] 156.228.105.119 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Jan 26 14:53:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.248
description:
[2025-01-26 14:53:06 +0100] info [whostmgrd] 104.207.49.248 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-01-26 14:53:18 dovecot_plain authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:57926: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.251
description:
[2025-01-26 14:52:56 +0100] info [cpaneld] 104.207.60.251 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.103
description:
[2025-01-26 14:52:57 +0100] info [cpaneld] 156.228.83.103 - ads19a00014y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads19a00014y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.89.143.234
description:
Jan 26 14:53:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.89.143.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.188
description:
[2025-01-26 14:53:05 +0100] info [whostmgrd] 156.228.112.188 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-01-26 14:53:31 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:33958: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.97.132
description:
[2025-01-26 14:52:55 +0100] info [cpaneld] 156.228.97.132 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-01-26 14:52:56 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:35310: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.46.152
description:
[2025-01-26 14:53:01 +0100] info [whostmgrd] 104.207.46.152 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-01-26 14:54:18 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:53790: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Jan 26 14:54:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Jan 26 14:54:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 26 14:54:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-01-26 14:54:33 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:34328: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 26 14:53:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-26 14:53:42 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:36038: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Jan 26 14:54:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.180.58
description:
Jan 26 14:53:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.180.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
description:
2025-01-26 14:54:26 dovecot_plain authenticator failed for ([196.28.226.125]) [196.28.226.125]:53729: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
description:
2025-01-26 14:53:59 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:35878: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-01-26 14:54:24 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:37388: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.125
description:
Jan 26 14:54:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 26 14:54:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-26 14:54:37 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:60581: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-26 14:53:42 dovecot_plain authenticator failed for (renion) [89.23.210.188]:44334: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.16.21.118
description:
Jan 26 14:53:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.16.21.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.21.118
description:
2025-01-26 14:53:44 dovecot_plain authenticator failed for (5x16x21x118.static-business.spb.ertelecom.ru) [5.16.21.118]:54568: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-01-26 14:54:35 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:37489: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 26 14:53:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Jan 26 14:54:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-26 14:54:35 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:52748: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
description:
Jan 26 14:54:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 26 14:54:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 26 14:54:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 26 14:55:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-26 14:55:20 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:46661: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
description:
Jan 26 14:54:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-26 14:54:43 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:63420: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-26 14:54:57 dovecot_plain authenticator failed for (recerely) [62.231.31.86]:56552: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.44.2.16
description:
[2025-01-26 14:55:07 +0100] info [webmaild] 187.44.2.16 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-26 14:55:08 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:45977: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 26 14:55:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 26 14:54:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 26 14:54:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-26 14:54:56 dovecot_login authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:6106: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
description:
Jan 26 14:54:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-01-26 14:54:55 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:52492: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
description:
2025-01-26 14:54:53 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:57779: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-01-26 14:54:42 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:47139: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-26 14:54:43 dovecot_login authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:60581: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 14:55:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 26 14:55:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-26 14:55:51 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:52462: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.243.136.120
description:
Jan 26 14:56:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.243.136.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.243.136.120
description:
2025-01-26 14:56:02 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:54098: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.168.25
description:
[2025-01-26 14:56:02 +0100] info [webmaild] 41.56.168.25 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 118.179.121.45
description:
[2025-01-26 14:56:07 +0100] info [webmaild] 118.179.121.45 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
description:
Jan 26 14:56:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.113
description:
[2025-01-26 14:56:58 +0100] info [cpaneld] 104.207.55.113 - ads21a00061y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21a00061y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
description:
2025-01-26 14:57:17 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:40376: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
description:
Jan 26 14:57:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.168
description:
[2025-01-26 14:56:59 +0100] info [whostmgrd] 156.228.110.168 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 26 14:57:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 26 14:57:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 26 14:57:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 26 14:56:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 26 14:56:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-26 14:56:57 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:56641: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.21.5.139
description:
Jan 26 14:56:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.21.5.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.21.5.139
description:
2025-01-26 14:56:51 dovecot_login authenticator failed for (dynamic.isp.ooredoo.om) [5.21.5.139]:54746: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.45
description:
[2025-01-26 14:56:56 +0100] info [cpaneld] 156.228.81.45 - ads21a00061y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21a00061y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.162
description:
[2025-01-26 14:56:58 +0100] info [whostmgrd] 104.207.41.162 - ads21a00061y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
description:
Jan 26 14:57:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.148
description:
[2025-01-26 14:56:57 +0100] info [cpaneld] 104.207.52.148 - ads21a00061y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21a00061y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.46.253
description:
[2025-01-26 14:56:59 +0100] info [whostmgrd] 104.207.46.253 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.238
description:
[2025-01-26 14:57:00 +0100] info [whostmgrd] 104.207.40.238 - ads21a00061y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-26 14:57:04 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:39714: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-01-26 14:57:07 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:34878: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 14:56:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.186
description:
[2025-01-26 14:56:56 +0100] info [cpaneld] 104.207.42.186 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Jan 26 14:57:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-26 14:57:07 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:32200: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-26 14:57:23 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:10678: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-26 14:56:52 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:45724: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
description:
2025-01-26 14:56:54 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:15920: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.174
description:
[2025-01-26 14:56:57 +0100] info [cpaneld] 156.228.104.174 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 26 14:57:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-26 14:57:03 dovecot_login authenticator failed for ([14.97.7.138]) [182.71.173.250]:50702: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.91
description:
[2025-01-26 14:56:58 +0100] info [whostmgrd] 156.228.98.91 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.49
description:
[2025-01-26 14:57:01 +0100] info [whostmgrd] 154.214.1.49 - ads21a00061y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
description:
2025-01-26 14:57:30 dovecot_plain authenticator failed for ([60.214.127.246]) [60.214.127.246]:26655: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 26 14:57:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.163.99.15
description:
[2025-01-26 14:57:50 +0100] info [webmaild] 200.163.99.15 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.86.92
description:
[2025-01-26 14:57:54 +0100] info [webmaild] 84.54.86.92 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.46
description:
Jan 26 14:58:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.46
description:
2025-01-26 14:58:25 dovecot_plain authenticator failed for ([61.185.226.46]) [61.185.226.46]:35959: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-01-26 14:58:13 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:59248: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.134.32.74
description:
2025-01-26 14:58:14 dovecot_plain authenticator failed for ([222.134.32.74]) [222.134.32.74]:39158: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
description:
Jan 26 14:58:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 26 14:57:45 ait sshd[2291150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 14:58:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-26 14:58:19 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:49215: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
description:
2025-01-26 14:58:23 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:41814: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-26 14:57:37 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:44376: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 26 14:57:45 ait sshd[2291150]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Jan 26 14:58:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.134.32.74
description:
Jan 26 14:58:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.134.32.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Jan 26 14:57:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-01-26 14:58:01 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:52749: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 26 14:58:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-26 14:59:24 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:47015: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-26 14:58:39 dovecot_login authenticator failed for ([183.105.138.168]) [211.35.237.38]:60886: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Jan 26 14:58:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.6.212.150
description:
2025-01-26 14:58:56 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.212.150]:56258: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 26 14:59:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-01-26 14:58:39 dovecot_login authenticator failed for ([60.8.250.139]) [60.8.250.139]:44268: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-01-26 14:58:53 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:40480: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 26 14:59:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.32.224
description:
[2025-01-26 14:59:27 +0100] info [webmaild] 191.99.32.224 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-26 14:59:27 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:43142: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 26 14:58:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.27.247.25
description:
2025-01-26 14:59:26 dovecot_login authenticator failed for (host-92-27-247-25.static.as13285.net) [92.27.247.25]:51360: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Jan 26 14:59:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-26 14:58:46 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:63069: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 26 14:59:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 26 14:59:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 26 14:58:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 26 14:58:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.27.247.25
description:
Jan 26 14:59:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.27.247.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-26 14:59:17 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:41162: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 14:59:20 ait sshd[2291841]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.250.139
description:
Jan 26 14:58:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-26 14:58:58 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:21399: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 26 14:59:20 ait sshd[2291841]: Invalid user waxmann-verlag.de 2a00 from 111.231.56.128 port 55544


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.57.104.89
description:
[2025-01-26 14:59:34 +0100] info [webmaild] 187.57.104.89 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.6.212.150
description:
Jan 26 14:58:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.6.212.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 14:59:20 ait sshd[2291841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Jan 26 14:59:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 26 15:00:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-01-26 14:59:38 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:33984: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-01-26 14:59:41 dovecot_login authenticator failed for ([50.171.64.170]) [50.171.64.170]:36862: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
description:
Jan 26 14:59:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 26 14:59:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-26 14:59:43 dovecot_plain authenticator failed for ([103.109.44.163]) [103.109.44.163]:55104: 535 Incorrect authentication data (set_id=jobs)


