# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-01-30 14:03:03 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:54700: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-02.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 14:02:39 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (cisop) [176.37.212.85]:51792: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 30 14:03:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 167.253.158.121
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-03.167.253.158.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 30 14:03:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 30 14:02:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.159.10
description:
[2025-01-30 14:02:40 +0100] info [webmaild] 170.239.159.10 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-30 14:03:26 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (impers) [83.254.126.238]:56282: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 30 14:03:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-01-30 14:03:35 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:47891: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.165.90
description:
2025-01-30 14:04:17 dovecot_plain authenticator failed for ([60.29.165.90]) [60.29.165.90]:35512: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.57
description:
47.128.54.57 - - [30/Jan/2025:14:04:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16191024 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C125%2C30%2C205&filter_course-language=121&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-30 14:03:22 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:63001: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-30 14:03:32 dovecot_plain authenticator failed for ([188.226.47.211]) [188.226.47.211]:59512: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 14:03:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 30 14:03:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Jan 30 14:03:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.42.154.251
description:
[2025-01-30 14:04:11 +0100] info [webmaild] 179.42.154.251 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.165.90
description:
Jan 30 14:04:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.165.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.15.229.181
description:
[2025-01-30 14:05:08 +0100] info [webmaild] 189.15.229.181 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.54
description:
2025-01-30 14:04:34 dovecot_plain authenticator failed for ([61.185.226.54]) [61.185.226.54]:59987: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.54
description:
Jan 30 14:04:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 30 14:05:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-30 14:05:15 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:12339: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.161.77
description:
2025-01-30 14:05:38 dovecot_login authenticator failed for ([117.253.161.77]) [117.253.161.77]:48822: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.246.82
description:
2025-01-30 14:05:47 dovecot_login authenticator failed for p59082-obmd01.osaka.ocn.ne.jp [153.141.246.82]:52509: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 30 14:06:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Jan 30 14:06:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-01-30 14:06:12 dovecot_login authenticator failed for (203-147-98-39.swoopbb.au) [203.147.98.39]:58412: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 14:05:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.161.77
description:
Jan 30 14:05:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.161.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.208.18
description:
[2025-01-30 14:05:46 +0100] info [webmaild] 102.219.208.18 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.120.40
description:
Jan 30 14:05:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.120.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
description:
2025-01-30 14:05:56 dovecot_login authenticator failed for ([39.152.120.40]) [39.152.120.40]:9512: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Jan 30 14:07:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-30 14:06:23 dovecot_login authenticator failed for ([211.52.131.183]) [211.52.131.183]:40742: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Jan 30 14:06:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.177.182.236
description:
[2025-01-30 14:06:35 +0100] info [webmaild] 191.177.182.236 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-30 14:07:21 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:37109: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 14:06:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.30.217.138
description:
2025-01-30 14:06:35 dovecot_login authenticator failed for ([127.0.0.1]) [123.30.217.138]:37742: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
description:
Jan 30 14:07:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
description:
2025-01-30 14:06:26 dovecot_login authenticator failed for ([127.0.0.1]) [222.163.236.235]:48122: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
description:
2025-01-30 14:07:09 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:34106: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 14:07:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.63.130
description:
47.128.63.130 - - [30/Jan/2025:14:08:13 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16222383 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=99%2C79%2C183&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.63.130


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.127.4.82
description:
[2025-01-30 14:08:20 +0100] info [webmaild] 103.127.4.82 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-01-30 14:08:53 dovecot_login authenticator failed for ([59.99.153.21]) [59.99.153.21]:10444: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Jan 30 14:09:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-01-30 14:09:03 dovecot_login authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:59210: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
description:
Jan 30 14:09:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 14:08:30 ait sshd[940443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 114.124.178.12
description:
[2025-01-30 14:08:37 +0100] info [cpaneld] 114.124.178.12 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.214.114.127
description:
[2025-01-30 14:09:17 +0100] info [webmaild] 179.214.114.127 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 30 14:08:30 ait sshd[940443]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 14:08:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.8.22.30
description:
2025-01-30 14:08:55 dovecot_plain authenticator failed for (30.22.8.221.adsl-pool.jlccptt.net.cn) [221.8.22.30]:49840: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Jan 30 14:08:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.8.22.30
description:
Jan 30 14:08:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.8.22.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
description:
2025-01-30 14:09:07 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:39871: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-01-30 14:09:44 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:41928: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-30 14:09:58 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:44147: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.218.138.211
description:
[2025-01-30 14:10:03 +0100] info [webmaild] 191.218.138.211 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.67
description:
47.128.112.67 - - [30/Jan/2025:14:10:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18301276 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/info.php?id=474" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.32.4.93
description:
2025-01-30 14:09:28 dovecot_plain authenticator failed for ([186.32.4.93]) [186.32.4.93]:41268: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Jan 30 14:09:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Jan 30 14:09:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 30 14:09:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.32.4.93
description:
Jan 30 14:09:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.32.4.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-01-30 14:09:47 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:56964: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-30 14:10:59 dovecot_plain authenticator failed for (unctalis) [109.166.70.166]:7590: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 14:11:01 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (recel) [51.255.84.180]:40412: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.170.228
description:
[2025-01-30 14:10:54 +0100] info [webmaild] 177.93.170.228 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 14:10:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 30 14:10:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.110.31.25
description:
[2025-01-30 14:10:49 +0100] info [cpaneld] 79.110.31.25 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Jan 30 14:12:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.198
description:
Jan 30 14:12:15 ait sshd[942324]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.198
description:
Jan 30 14:12:15 ait sshd[942324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.145.238
description:
2025-01-30 14:11:58 dovecot_login authenticator failed for ([127.0.0.1]) [171.237.145.238]:45242: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.7.135.13
description:
Jan 30 14:12:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.7.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.7.135.13
description:
2025-01-30 14:12:05 dovecot_plain authenticator failed for ([119.7.135.13]) [119.7.135.13]:43094: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 14:12:09 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (viond) [51.255.84.180]:59152: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.71
description:
Jan 30 14:11:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
description:
2025-01-30 14:12:01 dovecot_plain authenticator failed for (berisgow) [65.20.251.71]:35336: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-01-30 14:12:15 dovecot_login authenticator failed for ([127.0.0.1]) [27.223.100.90]:48604: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
description:
Jan 30 14:12:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.237.145.238
description:
Jan 30 14:11:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.237.145.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Jan 30 14:11:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 14:12:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
description:
2025-01-30 14:12:22 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:43248: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.198
description:
Jan 30 14:12:32 ait sshd[942499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.33.57.216
description:
[2025-01-30 14:12:51 +0100] info [webmaild] 187.33.57.216 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.198
description:
Jan 30 14:12:21 ait sshd[942324]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
description:
2025-01-30 14:13:25 dovecot_plain authenticator failed for ([195.158.14.232]) [195.158.14.232]:50050: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Jan 30 14:13:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-01-30 14:13:37 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:63454: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 14:14:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.14.232
description:
Jan 30 14:13:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.14.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.142.131
description:
[2025-01-30 14:13:47 +0100] info [webmaild] 45.236.142.131 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.152.118.104
description:
[2025-01-30 14:14:00 +0100] info [webmaild] 24.152.118.104 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 14:15:52 ait sshd[944464]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 14:15:52 ait sshd[944464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 14:16:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.90.129.81
description:
[2025-01-30 14:15:24 +0100] info [whostmgrd] 164.90.129.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
description:
Jan 30 14:15:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
description:
2025-01-30 14:15:41 dovecot_plain authenticator failed for (ancon) [65.20.253.152]:50843: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-16.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.109.75
description:
Jan 30 14:16:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.109.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.189.43.200
description:
[2025-01-30 14:17:06 +0100] info [webmaild] 181.189.43.200 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.245.88.248
description:
Jan 30 14:17:18 ait sshd[944976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.245.88.248


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.29.121.81
description:
Jan 30 14:18:02 ait sshd[945335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.29.121.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.29.121.81
description:
Jan 30 14:18:02 ait sshd[945335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.29.121.81  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.142.176.244
description:
[2025-01-30 14:18:10 +0100] info [webmaild] 41.142.176.244 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-30 14:17:45 dovecot_plain authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:50210: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.112.89.148
description:
[2025-01-30 14:17:56 +0100] info [webmaild] 85.112.89.148 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-01-30 14:17:30 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:54774: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 30 14:17:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.245.88.248
description:
Jan 30 14:17:20 ait sshd[944976]: Failed password for invalid user ftptemp from 47.245.88.248 port 42646 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
description:
Jan 30 14:17:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.113.36
description:
[2025-01-30 14:18:49 +0100] info [webmaild] 201.148.113.36 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 14:19:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 14:19:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.29.121.81
description:
Jan 30 14:20:52 ait sshd[946977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.29.121.81


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 30 14:20:58 ait sshd[946984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.212.19.9
description:
2025-01-30 14:20:26 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:39992: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.29.121.81
description:
Jan 30 14:20:52 ait sshd[946977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.29.121.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 14:20:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.212.19.9
description:
Jan 30 14:20:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.212.19.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Jan 30 14:20:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-01-30 14:20:47 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:1857: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 30 14:20:58 ait sshd[946984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Jan 30 14:21:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-30 14:21:51 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:49496: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.43.208
description:
[2025-01-30 14:21:57 +0100] info [webmaild] 131.196.43.208 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.29.121.81
description:
Jan 30 14:22:16 ait sshd[947499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.29.121.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.234.218
description:
[2025-01-30 14:22:18 +0100] info [webmaild] 45.224.234.218 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.159.87
description:
[2025-01-30 14:21:22 +0100] info [webmaild] 45.190.159.87 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 14:21:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-01-30 14:21:36 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:56443: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 30 14:21:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.29.121.81
description:
Jan 30 14:22:16 ait sshd[947499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.29.121.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.61.222.38
description:
[2025-01-30 14:22:18 +0100] info [cpaneld] 185.61.222.38 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
description:
Jan 30 14:23:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
description:
2025-01-30 14:23:08 dovecot_plain authenticator failed for ([203.193.137.250]) [203.193.137.250]:59788: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 14:22:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 14:22:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.47.207.226
description:
[2025-01-30 14:22:48 +0100] info [webmaild] 177.47.207.226 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.47.157
description:
Jan 30 14:23:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.47.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-30 14:23:45 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:65200: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.134.1.226
description:
Jan 30 14:23:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.134.1.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 30 14:24:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
description:
2025-01-30 14:23:32 dovecot_login authenticator failed for (CxMiFK4vm) [185.241.208.46]:60862: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.207.213
description:
Jan 30 14:23:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.207.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.213
description:
2025-01-30 14:23:42 dovecot_login authenticator failed for (197-255-207-213.netpagedns.net) [197.255.207.213]:54025: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 30 14:23:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
description:
2025-01-30 14:23:57 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:34020: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.47.157
description:
2025-01-30 14:23:21 dovecot_plain authenticator failed for ([222.116.47.157]) [222.116.47.157]:33257: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.233.251
description:
Jan 30 14:23:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.233.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
description:
Jan 30 14:23:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.79.38
description:
Jan 30 14:24:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.79.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.237.10
description:
Jan 30 14:24:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.237.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
description:
2025-01-30 14:24:06 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:57679: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.157.32.129
description:
Jan 30 14:23:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.157.32.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.157.32.129
description:
2025-01-30 14:23:55 dovecot_plain authenticator failed for ([41.157.32.129]) [41.157.32.129]:54424: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.79.38
description:
2025-01-30 14:24:04 dovecot_login authenticator failed for ([211.178.79.38]) [211.178.79.38]:44861: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-30 14:24:17 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:54086: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.21.254.67
description:
Jan 30 14:23:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.21.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
description:
2025-01-30 14:23:52 dovecot_login authenticator failed for 5.185.233.251.ipv4.public.orange.pl [5.185.233.251]:48716: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
description:
Jan 30 14:23:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.21.254.67
description:
2025-01-30 14:23:40 dovecot_login authenticator failed for ([127.0.0.1]) [37.21.254.67]:45804: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.1.226
description:
2025-01-30 14:23:55 dovecot_login authenticator failed for ([127.0.0.1]) [103.134.1.226]:60257: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 30 14:24:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 14:25:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.234
description:
Jan 30 14:24:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 14:24:46 ait sshd[948887]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 14:24:46 ait sshd[948887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-30 14:24:46 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:47172: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
description:
Jan 30 14:24:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.234
description:
2025-01-30 14:24:27 dovecot_plain authenticator failed for (furseclet) [65.20.169.234]:38640: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 30 14:24:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-30 14:24:55 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:6955: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
description:
Jan 30 14:25:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 30 14:24:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.246.91
description:
2025-01-30 14:24:40 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:55051: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.234.161.158
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:14-25.109.234.161.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
description:
2025-01-30 14:24:26 dovecot_login authenticator failed for (oIIfGQYPY) [185.241.208.46]:63478: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.42.100
description:
Jan 30 14:24:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.42.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-30 14:25:00 dovecot_login authenticator failed for ([171.244.40.236]) [171.244.40.236]:13221: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.11.106.104
description:
[2025-01-30 14:26:07 +0100] info [webmaild] 187.11.106.104 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
description:
2025-01-30 14:26:07 dovecot_login authenticator failed for (m121-202-200-120.smartone.com) [121.202.200.120]:57008: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.225
description:
Jan 30 14:26:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.225
description:
2025-01-30 14:26:20 dovecot_login authenticator failed for ([104.241.231.225]) [104.241.231.225]:47086: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
description:
2025-01-30 14:25:22 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (forturress) [80.14.31.158]:59425: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.179.219
description:
[2025-01-30 14:25:30 +0100] info [webmaild] 131.161.179.219 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 14:25:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
description:
Jan 30 14:26:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.6.3.147
description:
[2025-01-30 14:26:57 +0100] info [webmaild] 37.6.3.147 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.51.11.15
description:
[2025-01-30 14:26:25 +0100] info [webmaild] 77.51.11.15 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.214.235.139
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-28.195.214.235.139


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 198.244.228.126
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-28.198.244.228.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.62.88.221
description:
[2025-01-30 14:29:42 +0100] info [webmaild] 190.62.88.221 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 30 14:29:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.144.125
description:
2025-01-30 14:30:19 dovecot_login authenticator failed for ([127.0.0.1]) [219.157.144.125]:45704: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.241.177
description:
Jan 30 14:30:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.241.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
description:
2025-01-30 14:30:09 dovecot_login authenticator failed for ([127.0.0.1]) [176.226.241.177]:50196: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.144.125
description:
Jan 30 14:30:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.144.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-30 14:29:51 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:49186: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.42.0.198
description:
[2025-01-30 14:30:05 +0100] info [webmaild] 186.42.0.198 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-30 14:30:05 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:41859: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.110.32
description:
[2025-01-30 14:30:46 +0100] info [webmaild] 45.181.110.32 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.66.212.126
description:
Jan 30 14:30:57 ait sshd[953145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.66.212.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-30 14:30:35 dovecot_plain authenticator failed for (roelews) [185.113.51.55]:39859: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.73.86
description:
2025-01-30 14:30:56 dovecot_login authenticator failed for ([127.0.0.1]) [95.52.73.86]:57391: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 30 14:30:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.176.67
description:
Jan 30 14:30:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.73.86
description:
Jan 30 14:30:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.73.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.176.67
description:
2025-01-30 14:30:49 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.176.67]:34141: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.35.221
description:
[2025-01-30 14:31:00 +0100] info [webmaild] 177.223.35.221 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 30 14:31:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.116
description:
2025-01-30 14:31:37 dovecot_plain authenticator failed for ([122.187.227.116]) [122.187.227.116]:58872: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
description:
2025-01-30 14:31:47 dovecot_plain authenticator failed for ([154.127.43.35]) [154.127.43.35]:42174: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.116
description:
Jan 30 14:31:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.35
description:
Jan 30 14:31:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-30 14:31:25 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:36574: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-30 14:31:45 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:33871: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 30 14:31:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 30 14:33:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.20
description:
2025-01-30 14:32:48 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:50730: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.222.7.136
description:
2025-01-30 14:33:03 dovecot_login authenticator failed for (63-222-7-136.static.as3491.net) [63.222.7.136]:53162: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.221.25.242
description:
2025-01-30 14:33:06 dovecot_plain authenticator failed for (Marwa.2feok15dbpkuzkqwbsoic1amka.madx.internal.cloudapp.net) [68.221.25.242]:53138: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 14:33:10 ait sshd[954311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-30 14:33:20 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:15622: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.222.7.136
description:
Jan 30 14:33:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.222.7.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 14:33:10 ait sshd[954311]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.20
description:
Jan 30 14:32:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Jan 30 14:33:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.155.54.14
description:
[2025-01-30 14:33:48 +0100] info [webmaild] 105.155.54.14 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 68.221.25.242
description:
[2025-01-30 14:33:27 +0100] info [webmaild] 68.221.25.242 - laryea@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-01-30 14:33:34 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:41610: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 128.199.108.222
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-33.128.199.108.222


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.157.78.174
description:
[2025-01-30 14:34:18 +0100] info [webmaild] 105.157.78.174 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 30 14:35:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-30 14:35:17 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:40095: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.72.217.14
description:
[2025-01-30 14:34:52 +0100] info [webmaild] 190.72.217.14 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 30 14:34:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.57.45
description:
[2025-01-30 14:35:08 +0100] info [webmaild] 177.128.57.45 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-01-30 14:35:10 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:50301: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.143.77.111
description:
Jan 30 14:35:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.143.77.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-30 14:34:59 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:17233: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Jan 30 14:35:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.143.77.111
description:
2025-01-30 14:35:12 dovecot_login authenticator failed for ([220.189.239.206]) [183.143.77.111]:50118: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 14:35:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
description:
Jan 30 14:35:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
description:
Jan 30 14:35:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
description:
2025-01-30 14:36:08 dovecot_plain authenticator failed for ([110.38.70.172]) [110.38.70.172]:61793: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.126.65.135
description:
Jan 30 14:35:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.126.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.135
description:
2025-01-30 14:35:34 dovecot_plain authenticator failed for ([216.126.65.135]) [216.126.65.135]:53428: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
description:
2025-01-30 14:35:51 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:38840: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
description:
Jan 30 14:36:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
description:
Jan 30 14:36:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
description:
Jan 30 14:36:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
description:
2025-01-30 14:36:25 dovecot_plain authenticator failed for ([178.178.194.203]) [178.178.194.203]:34986: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-30 14:36:29 dovecot_plain authenticator failed for (inedophing) [77.51.214.170]:48865: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 30 14:36:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.92.121
description:
[2025-01-30 14:37:52 +0100] info [webmaild] 84.54.92.121 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.240.101.222
description:
Jan 30 14:37:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.240.101.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.240.101.222
description:
2025-01-30 14:37:26 dovecot_plain authenticator failed for p5df065de.dip0.t-ipconnect.de (kertily) [93.240.101.222]:47784: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
description:
2025-01-30 14:38:15 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:33232: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.112.141.230
description:
Jan 30 14:38:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.112.141.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Jan 30 14:38:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.148.247.141
description:
[2025-01-30 14:38:24 +0100] info [webmaild] 201.148.247.141 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 111.88.54.156
description:
[2025-01-30 14:38:52 +0100] info [webmaild] 111.88.54.156 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 14:39:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Jan 30 14:39:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.135.251
description:
2025-01-30 14:39:12 dovecot_plain authenticator failed for (rhadastis) [157.245.135.251]:47838: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.96
description:
[2025-01-30 14:39:15 +0100] info [webmaild] 213.230.93.96 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-01-30 14:38:24 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:36636: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.135.251
description:
Jan 30 14:39:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-01-30 14:39:13 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:52215: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.170.20
description:
2025-01-30 14:39:25 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:52958: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-30 14:39:27 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:58044: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
description:
2025-01-30 14:39:36 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:36271: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-30 14:40:10 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:59771: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 30 14:40:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-30 14:40:18 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:61026: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 30 14:39:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 30 14:40:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-30 14:40:05 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:11114: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 30 14:40:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.170.20
description:
Jan 30 14:39:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.170.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
description:
Jan 30 14:39:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.115.208
description:
Jan 30 14:40:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.115.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Jan 30 14:40:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
description:
2025-01-30 14:40:21 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:47344: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.59.211.214
description:
Jan 30 14:40:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.59.211.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Jan 30 14:40:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-01-30 14:40:22 dovecot_login authenticator failed for (5x167x48x130.dynamic.rostov.ertelecom.ru) [5.167.48.130]:48681: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.59.211.214
description:
2025-01-30 14:40:26 dovecot_login authenticator failed for ([201.59.211.214]) [201.59.211.214]:32902: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.47.199
description:
2025-01-30 14:40:28 dovecot_login authenticator failed for 24.115.47.199.res-cmts.hzl3.ptd.net [24.115.47.199]:59296: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.30.24
description:
Jan 30 14:41:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.30.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-30 14:40:59 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:58904: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.11.52.149
description:
2025-01-30 14:40:46 dovecot_login authenticator failed for ppp-58-11-52-149.revip2.asianet.co.th [58.11.52.149]:54009: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.30.24
description:
2025-01-30 14:41:07 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:37974: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
description:
2025-01-30 14:40:39 dovecot_login authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:41028: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 30 14:40:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
description:
Jan 30 14:40:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.201.190.156
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-40.195.201.190.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.47.199
description:
Jan 30 14:40:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.47.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
description:
2025-01-30 14:40:42 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:46615: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.224.178.231
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:14-41.104.224.178.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.74.68.130
description:
Jan 30 14:41:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.74.68.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.74.68.130
description:
2025-01-30 14:41:48 dovecot_login authenticator failed for ([103.74.68.130]) [103.74.68.130]:49853: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.248.171.45
description:
[2025-01-30 14:42:03 +0100] info [webmaild] 186.248.171.45 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.36
description:
47.128.62.36 - - [30/Jan/2025:14:41:23 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20388221 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C61%2C125&filter_course-language=79%2C183%2C99%2C95&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 30 14:42:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
description:
2025-01-30 14:42:06 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:60899: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 30 14:41:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-30 14:41:52 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:50377: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 113.11.82.156
description:
[2025-01-30 14:43:05 +0100] info [webmaild] 113.11.82.156 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 14:42:41 dovecot_plain authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:1541: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.46.30.144
description:
[2025-01-30 14:43:21 +0100] info [webmaild] 189.46.30.144 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 14:42:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-30 14:42:53 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:38340: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Jan 30 14:42:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-01-30 14:42:53 dovecot_plain authenticator failed for ([125.142.39.13]) [125.142.39.13]:56021: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 14:43:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Jan 30 14:42:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.234.9
description:
[2025-01-30 14:42:39 +0100] info [webmaild] 45.162.234.9 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-01-30 14:42:40 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:54922: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 14:43:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 30 14:42:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 30 14:44:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.235
description:
Jan 30 14:43:59 ait sshd[960077]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.235
description:
Jan 30 14:43:59 ait sshd[960077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.235  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-30 14:44:15 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:36028: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.67.121.58
description:
Jan 30 14:44:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.67.121.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Jan 30 14:43:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-01-30 14:43:58 dovecot_plain authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:58196: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
description:
2025-01-30 14:44:10 dovecot_plain authenticator failed for ([124.67.121.58]) [124.67.121.58]:39939: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
description:
Jan 30 14:44:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
description:
Jan 30 14:44:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
description:
2025-01-30 14:44:33 dovecot_login authenticator failed for ([183.249.1.112]) [183.249.1.112]:43118: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 30 14:44:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
description:
2025-01-30 14:44:50 dovecot_login authenticator failed for ([46.45.218.48]) [46.45.218.48]:59466: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 30 14:44:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-30 14:44:43 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:58142: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-30 14:44:31 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:41630: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.158
description:
Jan 30 14:46:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.158
description:
2025-01-30 14:46:13 dovecot_login authenticator failed for ([104.241.230.158]) [104.241.230.158]:44847: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 30 14:46:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-30 14:46:17 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:37694: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Jan 30 14:46:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-01-30 14:46:54 dovecot_login authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:57900: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-30 14:47:04 dovecot_login authenticator failed for (host-130-35-103-103.xlinkbd.net) [103.103.35.130]:43394: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
description:
Jan 30 14:46:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-01-30 14:46:33 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:34633: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Jan 30 14:46:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-30 14:46:54 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:53638: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-30 14:47:18 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:41068: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-30 14:46:38 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:33110: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 30 14:46:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 14:46:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
description:
2025-01-30 14:46:30 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:60558: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.119
description:
[2025-01-30 14:46:39 +0100] info [webmaild] 213.230.93.119 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-30 14:46:47 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:52242: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 30 14:47:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-30 14:47:17 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:14441: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.86.67.241
description:
[2025-01-30 14:46:23 +0100] info [webmaild] 200.86.67.241 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.250.241
description:
Jan 30 14:46:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.250.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.250.241
description:
2025-01-30 14:46:29 dovecot_login authenticator failed for ([31.141.250.241]) [31.141.250.241]:40818: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 30 14:46:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-01-30 14:47:05 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:39628: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 30 14:47:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Jan 30 14:46:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 30 14:47:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-01-30 14:46:49 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:49760: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Jan 30 14:47:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 30 14:46:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-30 14:47:23 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:49691: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-01-30 14:47:23 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:58817: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.68.12.96
description:
[2025-01-30 14:48:11 +0100] info [whostmgrd] 77.68.12.96 - daniel_admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.68.12.96
description:
Jan 30 14:48:12 ait sshd[962597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.68.12.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 30 14:47:55 ait sshd[962463]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 30 14:48:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 30 14:47:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 14:47:23 ait sshd[962177]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 14:47:23 ait sshd[962177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.121.203.200
description:
[2025-01-30 14:47:48 +0100] info [webmaild] 189.121.203.200 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.117.7.15
description:
2025-01-30 14:47:34 dovecot_login authenticator failed for ([150.117.7.15]) [150.117.7.15]:36587: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 30 14:47:55 ait sshd[962463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Jan 30 14:47:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.66.139.108
description:
[2025-01-30 14:47:24 +0100] info [webmaild] 181.66.139.108 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.117.7.15
description:
Jan 30 14:47:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.117.7.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.68.12.96
description:
Jan 30 14:48:12 ait sshd[962597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.68.12.96


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-30 14:48:19 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:59114: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.226.214
description:
2025-01-30 14:48:22 dovecot_plain authenticator failed for ([75.110.226.214]) [75.110.226.214]:58935: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-30 14:48:31 dovecot_login authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:41703: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-30 14:48:50 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:55704: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Jan 30 14:49:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.219
description:
Jan 30 14:49:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.226.214
description:
Jan 30 14:48:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-01-30 14:49:15 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:60173: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 30 14:48:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 30 14:48:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-30 14:48:31 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:34624: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
description:
2025-01-30 14:48:34 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:58322: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 30 14:48:59 ait sshd[962939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.219
description:
2025-01-30 14:49:17 dovecot_plain authenticator failed for ([60.31.181.219]) [60.31.181.219]:35467: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 30 14:48:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 14:48:59 ait sshd[962939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
description:
Jan 30 14:48:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 14:50:19 ait sshd[963554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
description:
Jan 30 14:49:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
description:
2025-01-30 14:49:29 dovecot_plain authenticator failed for ([180.104.103.146]) [180.104.103.146]:48677: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.247.74
description:
Jan 30 14:49:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.247.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 30 14:50:19 ait sshd[963554]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.247.74
description:
2025-01-30 14:49:34 dovecot_plain authenticator failed for ([183.234.247.74]) [183.234.247.74]:55634: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
description:
Jan 30 14:50:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 30 14:50:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-30 14:50:38 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:44366: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.74.51.249
description:
[2025-01-30 14:50:55 +0100] info [cpaneld] 45.74.51.249 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.214.15.250
description:
[2025-01-30 14:50:55 +0100] info [webmaild] 190.214.15.250 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.68.120.61
description:
[2025-01-30 14:50:32 +0100] info [webmaild] 102.68.120.61 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
description:
2025-01-30 14:50:31 dovecot_login authenticator failed for (hebei.22.121.in-addr.arpa) [121.22.99.2]:40242: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-30 14:50:49 dovecot_plain authenticator failed for (liscea) [65.20.183.209]:39234: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 30 14:50:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.109.103.118
description:
[2025-01-30 14:50:59 +0100] info [cpaneld] 103.109.103.118 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 30 14:51:04 ait sshd[964109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 30 14:51:04 ait sshd[964109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 14:51:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.168.69
description:
[2025-01-30 14:51:47 +0100] info [webmaild] 177.37.168.69 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.249.179
description:
2025-01-30 14:51:50 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.249.179]:46961: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.147.231
description:
Jan 30 14:51:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.147.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.147.231
description:
2025-01-30 14:51:59 dovecot_login authenticator failed for ([127.0.0.1]) [191.59.147.231]:41568: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 30 14:52:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.193.7
description:
Jan 30 14:52:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.193.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 30 14:51:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-30 14:51:39 dovecot_plain authenticator failed for (conpoloxis) [77.51.214.170]:34429: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 30 14:52:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-30 14:52:19 dovecot_login authenticator failed for ([220.182.11.126]) [220.182.11.126]:58555: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 30 14:51:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.249.179
description:
Jan 30 14:51:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.249.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-30 14:52:02 dovecot_plain authenticator failed for 9498.telnet.bg (protherium) [87.254.165.100]:37526: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.155.105.9
description:
[2025-01-30 14:51:27 +0100] info [webmaild] 105.155.105.9 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-30 14:52:27 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:26794: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
description:
2025-01-30 14:52:42 dovecot_login authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:38148: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.232.117.127
description:
Jan 30 14:52:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.232.117.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 30 14:53:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.193.7
description:
Jan 30 14:52:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.193.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
description:
Jan 30 14:52:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.232.117.127
description:
2025-01-30 14:52:54 dovecot_login authenticator failed for 118-232-117-127.dynamic.kbronet.com.tw [118.232.117.127]:57142: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-30 14:53:11 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:43917: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 30 14:52:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 30 14:53:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-30 14:53:28 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:52764: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.91.97.228
description:
Jan 30 14:53:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.91.97.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.97.228
description:
2025-01-30 14:53:44 dovecot_login authenticator failed for syn-172-091-097-228.res.spectrum.com (172-091-097-228.res.spectrum.com) [172.91.97.228]:53598: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
description:
Jan 30 14:53:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
description:
2025-01-30 14:53:51 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:33024: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.135.111.59
description:
[2025-01-30 14:55:14 +0100] info [webmaild] 151.135.111.59 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.35.128.243
description:
[2025-01-30 14:54:55 +0100] info [webmaild] 185.35.128.243 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 30 14:55:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.222.197
description:
[2025-01-30 14:55:45 +0100] info [webmaild] 45.163.222.197 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.32.39
description:
[2025-01-30 14:56:09 +0100] info [webmaild] 86.108.32.39 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.200.230.61
description:
2025-01-30 14:55:50 dovecot_login authenticator failed for ([127.0.0.1]) [12.200.230.61]:65118: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.200.230.61
description:
Jan 30 14:55:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.200.230.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
description:
Jan 30 14:55:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.169.41.188
description:
Jan 30 14:56:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.169.41.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.41.188
description:
2025-01-30 14:56:19 dovecot_login authenticator failed for ([127.0.0.1]) [113.169.41.188]:19545: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 30 14:55:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.212.209.205
description:
Jan 30 14:55:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.212.209.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
description:
2025-01-30 14:55:57 dovecot_login authenticator failed for ([127.0.0.1]) [211.202.71.21]:55216: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: elibrary.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads22a00059y@ait.edu.gh||WPU:ads22a00059y@ait.edu.gh||RSV:6.65||T:APACHE||MV:14-56.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.70.38
description:
Jan 30 14:57:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.70.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.70.38
description:
2025-01-30 14:57:09 dovecot_plain authenticator failed for ([218.108.70.38]) [218.108.70.38]:59922: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-01-30 14:56:46 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:41752: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.251.7
description:
Jan 30 14:56:55 ait sshd[966744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.251.7


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.170
description:
2025-01-30 14:57:20 dovecot_plain authenticator failed for ([220.77.182.170]) [220.77.182.170]:48215: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 30 14:56:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-30 14:56:27 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:33593: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 30 14:56:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-30 14:56:41 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:50400: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Jan 30 14:56:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 30 14:57:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-30 14:57:06 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:38574: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.170
description:
Jan 30 14:57:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 30 14:58:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-30 14:58:12 dovecot_login authenticator failed for ([41.93.113.138]) [41.93.113.138]:37902: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.97.172.217
description:
2025-01-30 14:58:17 dovecot_login authenticator failed for vmi2403972.contaboserver.net ([127.0.0.1]) [161.97.172.217]:51694: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.215.34
description:
2025-01-30 14:57:59 dovecot_login authenticator failed for ([31.141.215.34]) [31.141.215.34]:52370: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Jan 30 14:58:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-01-30 14:58:10 dovecot_login authenticator failed for ([188.227.66.92]) [188.227.66.92]:50596: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.215.34
description:
Jan 30 14:57:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.215.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.150.88.37
description:
2025-01-30 14:58:08 dovecot_login authenticator failed for ([127.0.0.1]) [121.150.88.37]:46112: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-30 14:58:00 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:38374: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.97.172.217
description:
Jan 30 14:58:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.97.172.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 30 14:57:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.150.88.37
description:
Jan 30 14:58:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.150.88.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 30 14:58:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 30 14:58:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-30 14:58:39 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:59358: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 30 14:58:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.247.90
description:
2025-01-30 14:59:00 dovecot_login authenticator failed for ([36.154.247.90]) [36.154.247.90]:58668: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 14:59:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.232.142
description:
[2025-01-30 14:59:01 +0100] info [webmaild] 45.167.232.142 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-30 14:58:34 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:43630: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-30 14:58:46 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:42297: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.247.90
description:
Jan 30 14:58:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-30 14:59:55 dovecot_login authenticator failed for ([103.69.244.39]) [103.69.244.39]:46672: 535 Incorrect authentication data (set_id=jaster@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
description:
2025-01-30 14:59:58 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:40880: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
description:
Jan 30 14:59:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 30 15:00:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-30 15:00:17 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:52990: 535 Incorrect authentication data (set_id=jaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.154.33.22
description:
[2025-01-30 15:00:19 +0100] info [webmaild] 186.154.33.22 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.151.50.189
description:
[2025-01-30 14:59:46 +0100] info [webmaild] 179.151.50.189 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.228.245
description:
[2025-01-30 14:59:51 +0100] info [webmaild] 181.94.228.245 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 30 14:59:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.68.12.96
description:
Jan 30 15:00:54 ait sshd[968860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.68.12.96  user=lemassne


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 30 15:00:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-30 15:01:08 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:64231: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 30 15:00:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-30 15:00:47 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:39898: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.68.12.96
description:
[2025-01-30 15:00:53 +0100] info [whostmgrd] 77.68.12.96 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 30 15:01:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-30 15:00:23 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:34830: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.68.12.96
description:
Jan 30 15:00:54 ait sshd[968860]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.68.12.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.252.218
description:
2025-01-30 15:01:35 dovecot_login authenticator failed for ([220.189.252.218]) [220.189.252.218]:45560: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 30 15:01:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 30 15:01:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 30 15:01:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 15:01:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-30 15:01:52 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:36985: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.79.38
description:
Jan 30 15:01:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.79.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-30 15:01:58 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:28805: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-30 15:01:23 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:41065: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.252.218
description:
Jan 30 15:01:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.252.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.79.38
description:
2025-01-30 15:01:37 dovecot_login authenticator failed for ([211.178.79.38]) [211.178.79.38]:51123: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 30 15:02:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-01-30 15:02:17 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:56742: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.183.247
description:
Jan 30 15:03:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.183.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
description:
Jan 30 15:03:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Jan 30 15:02:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 15:03:17 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:56344: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 30 15:02:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-30 15:02:45 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:37449: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.222.141
description:
[2025-01-30 15:03:02 +0100] info [webmaild] 138.117.222.141 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
description:
Jan 30 15:03:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
description:
Jan 30 15:02:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
description:
2025-01-30 15:02:34 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:41342: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-01-30 15:03:00 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:56915: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-01-30 15:03:09 dovecot_plain authenticator failed for ([178.178.222.56]) [178.178.222.56]:44368: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.183.247
description:
2025-01-30 15:03:18 dovecot_login authenticator failed for ([127.0.0.1]) [207.188.183.247]:45152: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 30 15:04:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
description:
Jan 30 15:04:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-30 15:03:36 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:44239: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
description:
2025-01-30 15:03:21 dovecot_login authenticator failed for ([127.0.0.1]) [146.120.208.148]:43437: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 30 15:03:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-30 15:04:03 dovecot_login authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:49980: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
description:
2025-01-30 15:04:12 dovecot_login authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:40874: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.205.147
description:
[2025-01-30 15:04:20 +0100] info [webmaild] 131.0.205.147 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-01-30 15:03:32 dovecot_login authenticator failed for ([127.0.0.1]) [203.172.213.166]:33691: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 30 15:03:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 15:03:36 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (const) [176.37.212.85]:34976: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Jan 30 15:03:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.47.86
description:
[2025-01-30 15:03:50 +0100] info [webmaild] 103.151.47.86 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.251.7
description:
Jan 30 15:04:04 ait sshd[970701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.251.7


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.62.160
description:
[2025-01-30 15:03:25 +0100] info [webmaild] 157.100.62.160 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
description:
2025-01-30 15:03:26 dovecot_login authenticator failed for ([127.0.0.1]) [66.90.89.66]:59792: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-30 15:03:27 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:42377: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.90.89.66
description:
Jan 30 15:03:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.90.89.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 30 15:03:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-30 15:05:16 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:43440: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.28.76
description:
2025-01-30 15:04:33 dovecot_plain authenticator failed for ([120.238.28.76]) [120.238.28.76]:34915: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
description:
Jan 30 15:04:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
description:
2025-01-30 15:04:59 dovecot_login authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:50020: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.15.180
description:
Jan 30 15:05:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
description:
Jan 30 15:04:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.15.180
description:
2025-01-30 15:05:05 dovecot_plain authenticator failed for ([188.59.15.180]) [188.59.15.180]:33022: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-30 15:05:09 dovecot_login authenticator failed for ([102.221.64.10]) [102.221.64.10]:60017: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Jan 30 15:04:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
description:
2025-01-30 15:04:44 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:48002: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
description:
Jan 30 15:04:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 30 15:05:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Jan 30 15:05:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-01-30 15:04:27 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:49044: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.28.76
description:
Jan 30 15:04:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.28.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
description:
2025-01-30 15:04:40 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:56917: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.125.146.242
description:
Jan 30 15:06:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.125.146.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.125.146.242
description:
2025-01-30 15:06:17 dovecot_plain authenticator failed for ([206.125.146.242]) [206.125.146.242]:54246: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 15:05:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Jan 30 15:06:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-01-30 15:06:46 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:46351: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
description:
2025-01-30 15:07:12 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:31410: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-01-30 15:06:39 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:55727: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Jan 30 15:07:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
description:
Jan 30 15:07:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.216.73.40
description:
[2025-01-30 15:08:19 +0100] info [webmaild] 102.216.73.40 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 30 15:07:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.61.183.212
description:
Jan 30 15:07:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.61.183.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.175.40
description:
2025-01-30 15:08:16 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.175.40]:47835: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 15:07:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.103.187.12
description:
Jan 30 15:07:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.103.187.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.34.26
description:
2025-01-30 15:07:28 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:44116: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.87.252.70
description:
[2025-01-30 15:07:38 +0100] info [webmaild] 201.87.252.70 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.149.132.99
description:
[2025-01-30 15:07:28 +0100] info [webmaild] 178.149.132.99 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.61.183.212
description:
2025-01-30 15:07:59 dovecot_login authenticator failed for host-82-61-183-212.retail.telecomitalia.it ([127.0.0.1]) [82.61.183.212]:56398: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.54.175.40
description:
Jan 30 15:08:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.54.175.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.65.146
description:
[2025-01-30 15:08:34 +0100] info [webmaild] 45.176.65.146 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
description:
2025-01-30 15:08:36 dovecot_plain authenticator failed for ([181.189.61.189]) [181.189.61.189]:50088: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 15:08:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
description:
Jan 30 15:09:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
description:
Jan 30 15:08:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-01-30 15:09:06 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:50632: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.180.84
description:
Jan 30 15:09:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 30 15:09:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
description:
2025-01-30 15:09:50 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:44046: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 30 15:10:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.180.84
description:
2025-01-30 15:09:22 dovecot_plain authenticator failed for ([120.238.180.84]) [120.238.180.84]:51192: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
description:
2025-01-30 15:09:32 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:58786: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Jan 30 15:09:36 ait sshd[973847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Jan 30 15:09:36 ait sshd[973847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-30 15:10:06 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:43758: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
description:
Jan 30 15:09:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-30 15:10:46 dovecot_plain authenticator failed for (raterse) [5.159.173.105]:48866: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 15:10:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.251.7
description:
Jan 30 15:11:13 ait sshd[974911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.251.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 30 15:10:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 15:12:27 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (herts) [51.255.84.180]:49978: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.56.115.66
description:
2025-01-30 15:12:17 dovecot_plain authenticator failed for ([103.56.115.66]) [103.56.115.66]:38032: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.77.142
description:
[2025-01-30 15:12:17 +0100] info [webmaild] 131.196.77.142 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 15:12:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 30 15:12:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-30 15:12:53 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:15322: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.115.66
description:
Jan 30 15:12:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.115.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.45.44
description:
[2025-01-30 15:12:34 +0100] info [webmaild] 187.183.45.44 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-01-30 15:13:42 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:39203: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Jan 30 15:13:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-01-30 15:13:37 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:36027: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
description:
Jan 30 15:13:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
description:
Jan 30 15:13:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Jan 30 15:13:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-01-30 15:13:05 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:45958: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Jan 30 15:13:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-30 15:13:31 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:41345: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
description:
2025-01-30 15:13:47 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:59662: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Jan 30 15:13:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.188.78.64
description:
Jan 30 15:14:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.188.78.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.255.15.121
description:
2025-01-30 15:14:16 dovecot_login authenticator failed for ([103.255.15.121]) [103.255.15.121]:41664: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 15:14:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.139
description:
Jan 30 15:14:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.139
description:
2025-01-30 15:14:58 dovecot_plain authenticator failed for ([221.13.67.139]) [221.13.67.139]:54380: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
description:
2025-01-30 15:14:00 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:51501: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.15.121
description:
Jan 30 15:14:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.15.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.188.78.64
description:
2025-01-30 15:14:44 dovecot_plain authenticator failed for ool-18bc4e40.dyn.optonline.net [24.188.78.64]:42042: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
description:
Jan 30 15:14:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
description:
2025-01-30 15:14:51 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:52061: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Jan 30 15:15:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 15:15:59 dovecot_plain authenticator failed for (undamatte) [207.188.157.230]:57381: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.123.122.103
description:
Jan 30 15:15:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.123.122.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.138.103.139
description:
[2025-01-30 15:15:10 +0100] info [cpaneld] 45.138.103.139 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-01-30 15:15:21 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:43306: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.27
description:
Jan 30 15:15:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-30 15:15:04 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:46419: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.114.107.29
description:
[2025-01-30 15:15:31 +0100] info [webmaild] 201.114.107.29 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.200.27
description:
[2025-01-30 15:15:52 +0100] info [webmaild] 187.73.200.27 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 30 15:15:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.193
description:
47.128.58.193 - - [30/Jan/2025:15:15:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16039828 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?filter_course-category=30&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 15:15:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.123.122.103
description:
2025-01-30 15:15:13 dovecot_plain authenticator failed for ([113.125.45.72]) [42.123.122.103]:39096: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Jan 30 15:15:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Jan 30 15:16:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.126.164
description:
[2025-01-30 15:16:20 +0100] info [webmaild] 138.117.126.164 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.144.87
description:
[2025-01-30 15:16:47 +0100] info [webmaild] 170.83.144.87 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
description:
2025-01-30 15:17:53 dovecot_login authenticator failed for ([58.18.89.146]) [58.18.89.146]:33208: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 30 15:17:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-01-30 15:17:36 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:58876: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Jan 30 15:17:40 ait sshd[978753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 15:17:39 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:57224: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 15:17:49 ait sshd[978795]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Jan 30 15:17:40 ait sshd[978753]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.128.249.19
description:
Jan 30 15:17:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.128.249.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 15:17:49 ait sshd[978795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-30 15:17:14 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:51269: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 30 15:17:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.249.19
description:
2025-01-30 15:17:26 dovecot_plain authenticator failed for 217-128-249-19.ftth.fr.orangecustomers.net (perwhers) [217.128.249.19]:53870: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-30 15:17:29 dovecot_plain authenticator failed for (ancale) [164.92.243.206]:56238: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.89.146
description:
Jan 30 15:17:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.89.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Jan 30 15:17:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 30 15:17:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-30 15:18:03 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:52450: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
description:
Jan 30 15:18:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 30 15:18:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-30 15:18:22 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:46382: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 30 15:18:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.38.121
description:
2025-01-30 15:18:19 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.38.121]:23544: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-30 15:18:33 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:37341: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.38.121
description:
Jan 30 15:18:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
description:
Jan 30 15:19:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.208
description:
Jan 30 15:19:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
description:
2025-01-30 15:19:24 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:45820: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
description:
Jan 30 15:19:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.230.214.243
description:
Jan 30 15:19:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.230.214.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.253
description:
Jan 30 15:19:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.253
description:
2025-01-30 15:19:55 dovecot_plain authenticator failed for (rastunk) [65.20.129.253]:59079: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 15:19:20 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (sheachi) [91.56.31.167]:59167: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
description:
2025-01-30 15:19:38 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:52846: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.230.214.243
description:
2025-01-30 15:19:49 dovecot_plain authenticator failed for c-85-230-214-243.bbcust.telenor.se (respess) [85.230.214.243]:55922: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 15:19:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
description:
2025-01-30 15:19:24 dovecot_plain authenticator failed for (bryle) [65.20.133.208]:38594: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 210.211.60.166
description:
[2025-01-30 15:19:27 +0100] info [webmaild] 210.211.60.166 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.202.11
description:
[2025-01-30 15:20:02 +0100] info [webmaild] 45.175.202.11 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.42.148
description:
[2025-01-30 15:20:17 +0100] info [webmaild] 91.106.42.148 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.5.26
description:
2025-01-30 15:20:45 dovecot_plain authenticator failed for ([183.237.5.26]) [183.237.5.26]:36398: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
description:
2025-01-30 15:20:53 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:29381: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.5.26
description:
Jan 30 15:20:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.5.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-30 15:20:55 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:62420: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 15:20:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
description:
Jan 30 15:20:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 30 15:20:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.111.40.13
description:
[2025-01-30 15:20:57 +0100] info [webmaild] 78.111.40.13 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.140.176.170
description:
2025-01-30 15:21:05 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:52189: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
description:
Jan 30 15:21:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-30 15:21:15 dovecot_login authenticator failed for ([195.252.209.189]) [195.252.209.189]:33004: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.31.12.187
description:
Jan 30 15:21:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.31.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 30 15:21:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 30 15:21:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.140.176.170
description:
Jan 30 15:21:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.140.176.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-30 15:21:26 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:49670: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
description:
2025-01-30 15:21:17 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:35082: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.31.12.187
description:
2025-01-30 15:21:51 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:44538: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.65.227
description:
Jan 30 15:22:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.65.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.26.98
description:
Jan 30 15:22:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.26.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.65.227
description:
2025-01-30 15:22:06 dovecot_login authenticator failed for ([121.147.65.227]) [121.147.65.227]:38446: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 15:22:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
description:
2025-01-30 15:22:51 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:64621: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.211.194.58
description:
2025-01-30 15:23:06 dovecot_login authenticator failed for ([60.211.194.58]) [60.211.194.58]:17870: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.75.85.86
description:
[2025-01-30 15:24:00 +0100] info [webmaild] 105.75.85.86 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 30 15:23:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-30 15:23:47 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:61113: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.124
description:
47.128.43.124 - - [30/Jan/2025:15:23:56 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17143035 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?duration=short%2Cmedium&filter_course-language=79&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.194.58
description:
Jan 30 15:23:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.194.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 15:24:00 ait sshd[982599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 30 15:23:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-30 15:23:33 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:55302: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 15:23:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 15:23:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 30 15:23:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-30 15:23:45 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:29147: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 15:24:00 ait sshd[982599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 82.215.99.174
description:
[2025-01-30 15:23:18 +0100] info [webmaild] 82.215.99.174 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-30 15:23:36 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:61570: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 30 15:23:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.45.90.114
description:
[2025-01-30 15:24:56 +0100] info [webmaild] 177.45.90.114 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.34.65.98
description:
[2025-01-30 15:24:06 +0100] info [webmaild] 27.34.65.98 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 15:24:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-30 15:24:52 dovecot_login authenticator failed for ([103.178.158.133]) [103.178.158.132]:46628: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 30 15:24:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 30 15:24:02 ait sshd[982599]: Failed password for invalid user ijari from 175.126.195.176 port 33054 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 30 15:24:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-30 15:24:56 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.132.14.159]:43242: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.252.217
description:
2025-01-30 15:25:34 dovecot_login authenticator failed for p96217-obmd01.tokyo.ocn.ne.jp [124.101.252.217]:52939: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Jan 30 15:25:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-30 15:25:22 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:45873: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 15:25:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Jan 30 15:25:46 ait sshd[983757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Jan 30 15:25:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Jan 30 15:25:46 ait sshd[983757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.237.8.37
description:
2025-01-30 15:25:06 dovecot_login authenticator failed for ([58.237.8.37]) [58.237.8.37]:38474: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.71.121.54
description:
2025-01-30 15:25:08 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:49323: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-30 15:25:27 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:46906: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-01-30 15:25:15 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:56287: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-01-30 15:25:57 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:54499: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.252.217
description:
Jan 30 15:25:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.252.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.237.8.37
description:
Jan 30 15:25:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.237.8.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 30 15:25:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 30 15:25:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.145
description:
Jan 30 15:25:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.237.145
description:
2025-01-30 15:25:39 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.237.145]:15650: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.71.121.54
description:
Jan 30 15:25:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.71.121.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
description:
Jan 30 15:25:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
description:
2025-01-30 15:25:31 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:38910: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.63.209
description:
2025-01-30 15:26:27 dovecot_plain authenticator failed for ([211.97.63.209]) [211.97.63.209]:53083: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
description:
2025-01-30 15:26:06 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:47878: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.68.50
description:
Jan 30 15:26:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.68.50
description:
2025-01-30 15:26:46 dovecot_plain authenticator failed for ([221.6.68.50]) [221.6.68.50]:55705: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.97.63.209
description:
Jan 30 15:26:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.97.63.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
description:
Jan 30 15:26:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-30 15:27:29 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:46268: 535 Incorrect authentication data (set_id=ads22a00122y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 30 15:27:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 30 15:27:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-30 15:27:39 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:42784: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.5
description:
2025-01-30 15:27:50 dovecot_login authenticator failed for ([104.241.235.5]) [104.241.235.5]:45358: 535 Incorrect authentication data (set_id=ads22a00122y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.29.241
description:
[2025-01-30 15:27:32 +0100] info [webmaild] 45.169.29.241 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.235.5
description:
Jan 30 15:27:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.235.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Jan 30 15:27:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-01-30 15:27:18 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:59837: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Jan 30 15:27:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-01-30 15:27:28 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:38890: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
description:
Jan 30 15:27:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
description:
2025-01-30 15:27:35 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:33538: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.129.135.86
description:
[2025-01-30 15:28:20 +0100] info [webmaild] 103.129.135.86 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.233.108
description:
Jan 30 15:28:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.233.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.207.195
description:
[2025-01-30 15:28:04 +0100] info [webmaild] 170.233.207.195 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 30 15:28:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-30 15:28:48 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:57215: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-30 15:28:37 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:54630: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 30 15:28:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.233.108
description:
2025-01-30 15:28:47 dovecot_login authenticator failed for bb116-14-233-108.singnet.com.sg ([127.0.0.1]) [116.14.233.108]:60573: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.59.26
description:
[2025-01-30 15:28:57 +0100] info [webmaild] 191.99.59.26 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.152.161
description:
Jan 30 15:28:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.34.147
description:
Jan 30 15:29:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.34.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 87.120.113.158
domain: elibrary-edu.net
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:titlemas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-30 15:29:54 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:57960: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.152.161
description:
2025-01-30 15:28:59 dovecot_login authenticator failed for p243161-obmd01.tokyo.ocn.ne.jp ([127.0.0.1]) [153.141.152.161]:36841: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 15:30:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.130.107
description:
Jan 30 15:30:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.130.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.130.107
description:
2025-01-30 15:30:05 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.130.107]:42111: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.31.126.43
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads17a00060y@ait.edu.gh||WPU:ads17a00060y@ait.edu.gh||RSV:6.65||T:APACHE||MV:15-31.193.31.126.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.71.81.182
description:
[2025-01-30 15:31:42 +0100] info [webmaild] 46.71.81.182 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.218.189.252
description:
[2025-01-30 15:32:32 +0100] info [webmaild] 201.218.189.252 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.91.86.84
description:
[2025-01-30 15:32:10 +0100] info [webmaild] 181.91.86.84 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 15:32:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Jan 30 15:33:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-01-30 15:33:10 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:44073: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-01-30 15:33:25 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:36728: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Jan 30 15:33:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.23.94
description:
[2025-01-30 15:33:05 +0100] info [webmaild] 170.239.23.94 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.138
description:
Jan 30 15:34:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.138
description:
2025-01-30 15:34:31 dovecot_plain authenticator failed for ([121.202.155.138]) [121.202.155.138]:21111: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.90.182
description:
Jan 30 15:34:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.90.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.90.182
description:
2025-01-30 15:34:47 dovecot_plain authenticator failed for (182.90.156.175.unknown.m1.com.sg) [175.156.90.182]:48181: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-30 15:35:03 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39165: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 15:35:58 ait sshd[989660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-30 15:35:12 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:45144: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 15:35:58 ait sshd[989660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.5.33.217
description:
[2025-01-30 15:35:39 +0100] info [webmaild] 190.5.33.217 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 30 15:35:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 15:35:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 30 15:35:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Jan 30 15:36:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 15:36:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 30 15:36:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.122.142.1
description:
[2025-01-30 15:36:13 +0100] info [webmaild] 103.122.142.1 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-01-30 15:36:15 dovecot_plain authenticator failed for (unchist) [65.20.155.91]:44867: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.43.70.161
description:
[2025-01-30 15:36:14 +0100] info [webmaild] 195.43.70.161 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-30 15:36:24 dovecot_plain authenticator failed for s2.legionusa.com (blaskinger) [159.203.87.228]:45538: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.38.249
description:
[2025-01-30 15:36:27 +0100] info [webmaild] 132.255.38.249 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.113.149.221
description:
[2025-01-30 15:37:08 +0100] info [webmaild] 103.113.149.221 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-30 15:38:07 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:38014: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 30 15:38:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 30 15:38:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-30 15:38:19 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:59870: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.195.6.177
description:
[2025-01-30 15:39:43 +0100] info [webmaild] 186.195.6.177 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 15:40:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.72.41.53
description:
[2025-01-30 15:40:31 +0100] info [webmaild] 188.72.41.53 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.33
description:
[2025-01-30 15:40:32 +0100] info [webmaild] 84.54.70.33 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 15:41:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.98.60
description:
[2025-01-30 15:41:27 +0100] info [webmaild] 170.79.98.60 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
description:
2025-01-30 15:42:18 dovecot_login authenticator failed for ([103.146.233.123]) [103.146.233.123]:36254: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Jan 30 15:42:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.199.129
description:
Jan 30 15:42:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.199.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
description:
Jan 30 15:42:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-01-30 15:42:37 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:51135: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.199.129
description:
2025-01-30 15:42:39 dovecot_plain authenticator failed for (mulatiotry) [89.23.199.129]:46129: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.42.85
description:
Jan 30 15:43:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.42.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 15:43:29 ait sshd[994365]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 15:43:29 ait sshd[994365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.63.227.252
description:
[2025-01-30 15:43:39 +0100] info [webmaild] 189.63.227.252 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 30 15:43:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-30 15:43:52 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:37732: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-01-30 15:43:55 dovecot_plain authenticator failed for ([203.124.42.85]) [203.124.42.85]:43667: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.22.46
description:
Jan 30 15:44:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.22.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
description:
Jan 30 15:44:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
description:
2025-01-30 15:44:12 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:36510: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.9.123
description:
[2025-01-30 15:44:29 +0100] info [webmaild] 170.239.9.123 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.253.209
description:
[2025-01-30 15:44:43 +0100] info [webmaild] 186.194.253.209 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.22.46
description:
2025-01-30 15:44:09 dovecot_plain authenticator failed for (186-201-180-17.customer.tdatabrasil.net.br) [187.93.22.46]:38616: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Jan 30 15:45:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Jan 30 15:45:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.98.112
description:
[2025-01-30 15:45:36 +0100] info [webmaild] 169.224.98.112 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 143.198.137.83
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-45.143.198.137.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.174.166
description:
Jan 30 15:45:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.174.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
description:
2025-01-30 15:45:52 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:57444: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
description:
Jan 30 15:45:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-01-30 15:45:32 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:57412: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.186.174.166
description:
2025-01-30 15:45:42 dovecot_plain authenticator failed for (138-186-174-166.redebandalarga.net.br) [138.186.174.166]:32930: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
description:
2025-01-30 15:45:52 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:58909: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
description:
Jan 30 15:45:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
description:
2025-01-30 15:46:01 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:53223: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-30 15:46:02 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:52517: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.62
description:
Jan 30 15:46:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.122.177.159
description:
Jan 30 15:46:11 ait sshd[996256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.122.177.159  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 30 15:46:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.62
description:
2025-01-30 15:46:11 dovecot_plain authenticator failed for (overid) [62.182.116.62]:37816: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-30 15:47:34 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:49360: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 15:47:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.38.121
description:
Jan 30 15:47:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
description:
2025-01-30 15:47:44 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:48666: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 30 15:47:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
description:
Jan 30 15:47:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.127.205.91
description:
Jan 30 15:47:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.127.205.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.30.162.76
description:
[2025-01-30 15:47:37 +0100] info [webmaild] 191.30.162.76 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 15:47:37 dovecot_plain authenticator failed for (uncertave) [207.188.157.230]:31240: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.235.184
description:
[2025-01-30 15:48:26 +0100] info [webmaild] 177.126.235.184 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.202.241
description:
Jan 30 15:48:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.202.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.4.76.1
description:
[2025-01-30 15:48:39 +0100] info [webmaild] 189.4.76.1 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.23.147
description:
Jan 30 15:48:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.23.147 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.122.177.159
description:
Jan 30 15:49:13 ait sshd[997841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.122.177.159  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.86.31
description:
[2025-01-30 15:49:33 +0100] info [webmaild] 168.232.86.31 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
description:
Jan 30 15:49:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
description:
2025-01-30 15:49:47 dovecot_login authenticator failed for ([127.0.0.1]) [191.59.192.17]:50942: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.23.147
description:
Jan 30 15:49:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.23.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 30 15:50:42 ait sshd[999063]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.220.155
description:
Jan 30 15:50:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.220.155
description:
2025-01-30 15:50:06 dovecot_login authenticator failed for ([127.0.0.1]) [5.142.220.155]:40156: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 15:50:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 30 15:50:42 ait sshd[999063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.177.186.95
description:
[2025-01-30 15:51:35 +0100] info [webmaild] 186.177.186.95 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.91
description:
[2025-01-30 15:51:08 +0100] info [cpaneld] 156.228.110.91 - ads20b00297y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00297y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.79.193
description:
[2025-01-30 15:51:12 +0100] info [whostmgrd] 156.228.79.193 - ads20b00297y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.31
description:
[2025-01-30 15:51:13 +0100] info [whostmgrd] 104.207.35.31 - ads20b00297y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.106
description:
[2025-01-30 15:51:13 +0100] info [whostmgrd] 104.207.32.106 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.82.82
description:
[2025-01-30 15:51:09 +0100] info [cpaneld] 156.228.82.82 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.88.122
description:
[2025-01-30 15:51:11 +0100] info [cpaneld] 156.228.88.122 - ads20b00297y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00297y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.77.80
description:
[2025-01-30 15:51:10 +0100] info [cpaneld] 156.228.77.80 - ads20b00297y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00297y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.113.208
description:
[2025-01-30 15:51:11 +0100] info [whostmgrd] 156.228.113.208 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.252
description:
[2025-01-30 15:51:09 +0100] info [cpaneld] 104.207.59.252 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.90
description:
[2025-01-30 15:51:13 +0100] info [whostmgrd] 104.207.60.90 - ads20b00297y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Jan 30 15:52:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-01-30 15:52:15 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:62981: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.191.190
description:
[2025-01-30 15:52:24 +0100] info [webmaild] 179.125.191.190 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Jan 30 15:52:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-01-30 15:52:31 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:9486: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.177.221.155
description:
[2025-01-30 15:52:35 +0100] info [webmaild] 196.177.221.155 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 15:52:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.195.174.250
description:
2025-01-30 15:53:15 dovecot_plain authenticator failed for ([175.195.174.250]) [175.195.174.250]:33964: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-30 15:53:31 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:48638: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.24
description:
Jan 30 15:53:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.102.33
description:
Jan 30 15:53:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.102.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.102.33
description:
2025-01-30 15:53:10 dovecot_plain authenticator failed for ([112.186.102.33]) [112.186.102.33]:34408: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.148.249
description:
2025-01-30 15:53:27 dovecot_plain authenticator failed for ([120.71.148.249]) [120.71.148.249]:46430: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 30 15:53:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.190.184.218
description:
[2025-01-30 15:53:30 +0100] info [webmaild] 188.190.184.218 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.172.24
description:
2025-01-30 15:53:44 dovecot_plain authenticator failed for (tater) [65.20.172.24]:43859: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.195.174.250
description:
Jan 30 15:53:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.195.174.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.148.249
description:
Jan 30 15:53:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.148.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.65.20
description:
Jan 30 15:54:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.65.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.65.20
description:
2025-01-30 15:54:45 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.65.20]:33597: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 15:54:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
description:
Jan 30 15:54:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
description:
2025-01-30 15:54:53 dovecot_login authenticator failed for ([127.0.0.1]) [82.208.71.101]:52366: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-01-30 15:55:50 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:48740: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 15:55:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 30 15:55:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.91.144
description:
2025-01-30 15:55:21 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:32812: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.82.126
description:
[2025-01-30 15:55:40 +0100] info [webmaild] 213.230.82.126 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.91.144
description:
Jan 30 15:55:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.91.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-30 15:55:34 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:53503: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
description:
Jan 30 15:55:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.180
description:
Jan 30 15:56:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.116.184
description:
Jan 30 15:56:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.116.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
description:
2025-01-30 15:56:32 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:44556: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.249.229
description:
[2025-01-30 15:56:37 +0100] info [webmaild] 45.186.249.229 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Jan 30 15:56:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-01-30 15:56:17 dovecot_login authenticator failed for ([65.20.204.34]) [65.20.204.34]:44371: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.180
description:
2025-01-30 15:56:03 dovecot_plain authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:43643: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.16.73.204
description:
[2025-01-30 15:56:27 +0100] info [webmaild] 62.16.73.204 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 15:57:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 15:57:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.57.176.177
description:
[2025-01-30 15:57:31 +0100] info [webmaild] 37.57.176.177 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 15:57:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.167
description:
47.128.40.167 - - [30/Jan/2025:15:58:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22064901 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/4/?duration=short&filtering=1&instructor=2&level=beginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.167


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.125.50
description:
47.128.125.50 - - [30/Jan/2025:15:58:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=802978 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?duration=short%2Clong&filter_course-category=61&filtering=1&instructor=2&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.125.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.95.12.98
description:
[2025-01-30 15:59:39 +0100] info [webmaild] 179.95.12.98 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.197.38
description:
Jan 30 15:59:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 15:59:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-01-30 15:59:57 dovecot_login authenticator failed for ([141.94.18.69]) [141.94.18.69]:35752: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Jan 30 15:59:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.235.194.188
domain: gvu.university
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-59.147.235.194.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.197.38
description:
2025-01-30 15:59:44 dovecot_login authenticator failed for ([166.195.197.38]) [166.195.197.38]:48789: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.116.97.124
description:
[2025-01-30 16:00:29 +0100] info [webmaild] 179.116.97.124 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.109.7
description:
[2025-01-30 16:00:39 +0100] info [webmaild] 45.169.109.7 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.235.155.171
description:
[2025-01-30 16:01:33 +0100] info [webmaild] 45.235.155.171 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.216.249
description:
Jan 30 16:00:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.216.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.28.237
description:
Jan 30 16:01:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.28.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.28.237
description:
2025-01-30 16:01:14 dovecot_login authenticator failed for host-79-21-28-237.retail.telecomitalia.it ([127.0.0.1]) [79.21.28.237]:42318: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.52.218
description:
Jan 30 16:01:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.52.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.216.249
description:
2025-01-30 16:01:01 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.216.249]:57962: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.52.218
description:
2025-01-30 16:01:18 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no (scory) [94.246.52.218]:46729: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Jan 30 16:03:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
description:
Jan 30 16:03:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
description:
2025-01-30 16:03:27 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:58406: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 16:03:50 ait sshd[1007404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
description:
Jan 30 16:03:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.210.154
description:
[2025-01-30 16:03:36 +0100] info [webmaild] 177.104.210.154 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Jan 30 16:03:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-01-30 16:03:06 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:40956: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-01-30 16:03:10 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:46466: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
description:
2025-01-30 16:03:17 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:51247: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 16:03:50 ait sshd[1007404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-30 16:04:42 dovecot_plain authenticator failed for (trepes) [109.166.70.166]:53179: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.69.35.49
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/xmrlpc.php||SC:/home/ait02/public_html/wp-admin/images/xmrlpc.php


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.34.129.166
description:
[2025-01-30 16:04:25 +0100] info [webmaild] 177.34.129.166 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.139.28
description:
[2025-01-30 16:04:37 +0100] info [webmaild] 45.71.139.28 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
description:
Jan 30 16:04:23 ait sshd[1007819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
description:
Jan 30 16:04:23 ait sshd[1007819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 40.69.35.49
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-04.40.69.35.49||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 30 16:04:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 30 16:05:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-30 16:05:17 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:51998: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.133.20.191
description:
[2025-01-30 16:05:31 +0100] info [webmaild] 190.133.20.191 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.74.68.130
description:
Jan 30 16:05:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.74.68.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.74.68.130
description:
2025-01-30 16:05:02 dovecot_login authenticator failed for ([103.74.68.130]) [103.74.68.130]:54072: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.51.28.60
description:
Jan 30 16:06:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.51.28.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.51.28.60
description:
2025-01-30 16:06:10 dovecot_plain authenticator failed for (123-51-28-60.static.dsl.net.au) [123.51.28.60]:45302: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 30 16:06:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 30 16:06:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
description:
Jan 30 16:06:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-30 16:06:25 dovecot_login authenticator failed for ([200.223.193.9]) [200.223.192.254]:48920: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 16:06:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-30 16:06:21 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:35690: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
description:
2025-01-30 16:06:33 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:47612: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
description:
Jan 30 16:07:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
description:
Jan 30 16:07:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.18.65.242
description:
[2025-01-30 16:07:39 +0100] info [webmaild] 46.18.65.242 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
description:
2025-01-30 16:07:11 dovecot_login authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:49733: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-01-30 16:07:21 dovecot_login authenticator failed for ([178.178.222.47]) [178.178.222.47]:32790: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.189.97.154
description:
[2025-01-30 16:08:35 +0100] info [webmaild] 186.189.97.154 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.233
description:
Jan 30 16:08:38 ait sshd[1010122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.233  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.112.220.131
description:
[2025-01-30 16:08:28 +0100] info [webmaild] 200.112.220.131 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.233
description:
Jan 30 16:08:38 ait sshd[1010122]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.38.13.57
description:
Jan 30 16:09:44 ait sshd[1010723]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.38.13.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.30.96.141
description:
[2025-01-30 16:09:29 +0100] info [webmaild] 189.30.96.141 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.38.13.57
description:
Jan 30 16:09:44 ait sshd[1010723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.38.13.57


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.38.13.57
description:
Jan 30 16:10:00 ait sshd[1010723]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.38.13.57 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.38.13.57
description:
Jan 30 16:10:02 ait sshd[1010723]: Failed password for invalid user pi from 14.38.13.57 port 61536 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.42.196
description:
Jan 30 16:10:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.42.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.42.196
description:
2025-01-30 16:10:26 dovecot_plain authenticator failed for 221-120-42-196.emome-ip.hinet.net [221.120.42.196]:38301: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
description:
2025-01-30 16:10:38 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:60152: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.79.117
description:
Jan 30 16:10:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.79.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
description:
Jan 30 16:10:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.37.79.117
description:
2025-01-30 16:10:38 dovecot_plain authenticator failed for (dsl-104-37-79-117.dellcity.com) [104.37.79.117]:58294: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Jan 30 16:10:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-01-30 16:10:25 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:60286: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 16:10:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-30 16:12:04 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:53861: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 16:12:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.71.95.113
description:
[2025-01-30 16:12:40 +0100] info [webmaild] 177.71.95.113 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
description:
2025-01-30 16:12:00 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:48691: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.1.18
description:
[2025-01-30 16:12:26 +0100] info [webmaild] 170.238.1.18 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.201.78.193
description:
Jan 30 16:12:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.201.78.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.201.78.193
description:
2025-01-30 16:12:39 dovecot_plain authenticator failed for ([175.201.78.193]) [175.201.78.193]:47020: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 16:12:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 30 16:12:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.77
description:
2025-01-30 16:12:20 dovecot_plain authenticator failed for ([39.88.252.77]) [39.88.252.77]:46530: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.77
description:
Jan 30 16:12:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.33
description:
[2025-01-30 16:13:32 +0100] info [webmaild] 213.230.86.33 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.51.129.5
description:
Jan 30 16:14:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.51.129.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.50.134.183
description:
Jan 30 16:14:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.50.134.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Jan 30 16:15:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 16:14:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 16:14:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.50.134.183
description:
2025-01-30 16:14:52 dovecot_plain authenticator failed for ([77.50.134.183]) [77.50.134.183]:60664: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.225.12
description:
Jan 30 16:14:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.225.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.51.129.5
description:
2025-01-30 16:14:43 dovecot_plain authenticator failed for 206-51-129-5.nktelco.net [206.51.129.5]:34686: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-30 16:15:11 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:33354: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.225.12
description:
2025-01-30 16:15:01 dovecot_login authenticator failed for p38012-obmd01.osaka.ocn.ne.jp ([127.0.0.1]) [153.141.225.12]:53726: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-01-30 16:15:02 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:55705: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 30 16:15:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.116.7.67
description:
[2025-01-30 16:15:36 +0100] info [webmaild] 41.116.7.67 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.97.10
description:
47.128.97.10 - - [30/Jan/2025:16:16:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28430782 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/photoshop/?duration=medium&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.97.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.138.162
description:
Jan 30 16:16:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 30 16:16:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-01-30 16:16:39 dovecot_plain authenticator failed for ([196.207.241.168]) [196.207.241.168]:60643: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.223.248
description:
[2025-01-30 16:16:25 +0100] info [webmaild] 45.227.223.248 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.138.162
description:
2025-01-30 16:16:27 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:41613: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Jan 30 16:16:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.172.239
description:
[2025-01-30 16:16:44 +0100] info [webmaild] 151.236.172.239 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-30 16:16:41 dovecot_plain authenticator failed for (coduckling) [178.250.191.189]:39122: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.127.206.85
description:
[2025-01-30 16:17:40 +0100] info [webmaild] 189.127.206.85 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
description:
2025-01-30 16:17:29 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:26451: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Jan 30 16:17:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
description:
Jan 30 16:17:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Jan 30 16:17:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 30 16:17:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-30 16:17:27 dovecot_plain authenticator failed for s2.legionusa.com (pycresatly) [159.203.87.228]:40923: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.11
description:
47.128.122.11 - - [30/Jan/2025:16:17:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19073951 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?filter_course-category=205&filtering=1&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-01-30 16:17:47 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:26570: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-30 16:18:58 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:39934: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-01-30 16:18:01 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:49409: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
description:
2025-01-30 16:18:55 dovecot_plain authenticator failed for ([2.55.114.171]) [2.55.114.171]:54986: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.114.171
description:
Jan 30 16:18:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.114.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 30 16:18:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-01-30 16:19:07 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:20748: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.202.61.155
description:
Jan 30 16:19:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.202.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.61.155
description:
2025-01-30 16:19:09 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:58200: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Jan 30 16:19:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.242.243
description:
[2025-01-30 16:19:36 +0100] info [webmaild] 201.182.242.243 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.31
description:
[2025-01-30 16:20:25 +0100] info [webmaild] 213.230.87.31 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.174.18
description:
[2025-01-30 16:21:01 +0100] info [webmaild] 191.243.174.18 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.208.237.84
description:
[2025-01-30 16:21:41 +0100] info [webmaild] 186.208.237.84 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.122.40
description:
Jan 30 16:21:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.122.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.122.40
description:
2025-01-30 16:21:23 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.122.40]:56064: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Jan 30 16:21:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-01-30 16:21:32 dovecot_login authenticator failed for ([127.0.0.1]) [116.86.99.64]:45247: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 30 16:22:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
description:
2025-01-30 16:22:43 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:61510: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-30 16:22:32 dovecot_login authenticator failed for ([65.20.213.101]) [65.20.213.101]:51536: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
description:
Jan 30 16:22:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
description:
2025-01-30 16:23:57 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:56559: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-30 16:23:46 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:19147: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
description:
Jan 30 16:23:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.139.202
description:
[2025-01-30 16:23:30 +0100] info [webmaild] 45.228.139.202 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 30 16:23:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 30 16:23:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-01-30 16:23:53 dovecot_login authenticator failed for ([72.26.178.196]) [72.26.178.196]:54096: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-01-30 16:24:32 dovecot_login authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:51238: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-30 16:24:48 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:29162: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 30 16:24:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Jan 30 16:24:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-30 16:24:35 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:53152: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 30 16:24:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-30 16:24:22 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:21435: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 30 16:24:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.76.107
description:
[2025-01-30 16:24:38 +0100] info [webmaild] 170.80.76.107 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 30 16:24:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-30 16:24:07 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:59546: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.54.100
description:
[2025-01-30 16:24:19 +0100] info [webmaild] 131.221.54.100 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
description:
2025-01-30 16:25:17 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:35250: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Jan 30 16:25:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-01-30 16:25:12 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:42537: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 30 16:25:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
description:
2025-01-30 16:25:22 dovecot_plain authenticator failed for ([1.27.171.154]) [1.27.171.154]:53518: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
description:
Jan 30 16:25:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Jan 30 16:25:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-30 16:25:49 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:53610: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
description:
Jan 30 16:25:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-01-30 16:25:08 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:60449: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.1.225.241
description:
[2025-01-30 16:25:30 +0100] info [webmaild] 206.1.225.241 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 30 16:25:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-30 16:25:37 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:15020: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.255.246.226
description:
Jan 30 16:26:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.255.246.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.130.107
description:
2025-01-30 16:26:22 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.130.107]:51351: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.255.246.226
description:
2025-01-30 16:26:12 dovecot_login authenticator failed for 84-255-246-226.static.t-2.net ([127.0.0.1]) [84.255.246.226]:57350: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.82.226.220
description:
Jan 30 16:26:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.82.226.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.226.220
description:
2025-01-30 16:26:49 dovecot_plain authenticator failed for ([95.82.226.220]) [95.82.226.220]:54784: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.130.107
description:
Jan 30 16:26:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.130.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.202.224
description:
[2025-01-30 16:27:22 +0100] info [webmaild] 45.186.202.224 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
description:
2025-01-30 16:27:22 dovecot_plain authenticator failed for (187-92-192-154.customer.tdatabrasil.net.br) [187.92.192.154]:55917: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
description:
Jan 30 16:27:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-30 16:28:25 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:49642: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.41.188
description:
2025-01-30 16:28:27 dovecot_login authenticator failed for ([127.0.0.1]) [113.169.41.188]:35489: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 16:28:24 ait sshd[1023094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.169.41.188
description:
Jan 30 16:28:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.169.41.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 16:28:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Jan 30 16:28:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-01-30 16:28:37 dovecot_login authenticator failed for ([127.0.0.1]) [116.86.99.64]:50886: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 16:28:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.124.63.9
description:
[2025-01-30 16:28:34 +0100] info [webmaild] 190.124.63.9 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 30 16:28:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 30 16:28:24 ait sshd[1023094]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 30 16:28:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.238.194.188
description:
[2025-01-30 16:28:12 +0100] info [webmaild] 88.238.194.188 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-30 16:28:12 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:42821: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 30 16:29:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Jan 30 16:29:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-01-30 16:29:57 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:46145: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-30 16:29:16 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:48574: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-30 16:29:07 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:33934: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 30 16:29:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 16:29:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.213.132.134
description:
[2025-01-30 16:29:27 +0100] info [webmaild] 102.213.132.134 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 30 16:29:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-30 16:29:43 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:36343: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 16:30:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-30 16:30:53 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:52994: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 30 16:30:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 30 16:30:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-30 16:30:56 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net (niagork) [51.77.193.92]:44262: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.69.19.179
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/2014/06/autoload_classmap.php||SC:/home/ait02/public_html/wp-content/uploads/2014


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.40.138.52
description:
[2025-01-30 16:31:17 +0100] info [webmaild] 176.40.138.52 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 30 16:31:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 40.69.19.179
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-31.40.69.19.179||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.53
description:
Jan 30 16:31:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-30 16:31:04 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:56586: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 16:31:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-30 16:31:37 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:52193: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
description:
2025-01-30 16:31:49 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:43991: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 30 16:31:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.32.79.232
description:
[2025-01-30 16:32:34 +0100] info [webmaild] 191.32.79.232 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
description:
Jan 30 16:32:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-01-30 16:32:23 dovecot_login authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:51867: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-30 16:32:04 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:49230: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.200.247
description:
Jan 30 16:32:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.200.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.200.247
description:
2025-01-30 16:32:29 dovecot_plain authenticator failed for ([120.234.200.247]) [120.234.200.247]:43013: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.95
description:
Jan 30 16:32:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 30 16:32:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
description:
2025-01-30 16:32:42 dovecot_login authenticator failed for ([58.242.86.203]) [58.242.86.203]:55757: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.78.228
description:
[2025-01-30 16:32:07 +0100] info [webmaild] 131.196.78.228 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Jan 30 16:32:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-30 16:32:02 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (jutables) [83.254.126.238]:34874: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 30 16:32:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.95
description:
2025-01-30 16:32:32 dovecot_login authenticator failed for (95-179-53-194.mairnet.net) [194.53.179.95]:51174: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-30 16:32:37 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:53772: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 30 16:32:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.90
description:
[2025-01-30 16:33:26 +0100] info [webmaild] 84.54.73.90 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 16:33:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 16:34:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.103.116
description:
2025-01-30 16:34:57 dovecot_plain authenticator failed for ([117.198.103.116]) [117.198.103.116]:51383: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 30 16:34:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.103.116
description:
Jan 30 16:34:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.103.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 16:34:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-30 16:34:15 dovecot_plain authenticator failed for 9498.telnet.bg (subillae) [87.254.165.100]:45464: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-01-30 16:34:36 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:45636: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-01-30 16:34:23 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:56136: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Jan 30 16:34:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-34.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Jan 30 16:34:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 30 16:35:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-30 16:35:42 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:40069: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
description:
2025-01-30 16:35:11 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:49146: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
description:
2025-01-30 16:35:18 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:12288: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.134
description:
2025-01-30 16:35:26 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:47860: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
description:
Jan 30 16:35:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.49.14
description:
Jan 30 16:35:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.49.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-30 16:35:22 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:41980: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.134
description:
Jan 30 16:35:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 30 16:35:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-30 16:35:04 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:56648: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.74
description:
Jan 30 16:35:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.74
description:
2025-01-30 16:35:07 dovecot_login authenticator failed for ([104.241.230.74]) [104.241.230.74]:41933: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 30 16:35:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-30 16:36:33 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:52694: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.232
description:
[2025-01-30 16:36:34 +0100] info [webmaild] 198.163.193.232 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
description:
Jan 30 16:36:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-01-30 16:36:44 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:44483: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.115.90
description:
Jan 30 16:36:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.115.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-01-30 16:36:56 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:35318: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.115.90
description:
2025-01-30 16:36:53 dovecot_plain authenticator failed for (abts-north-static-090.115.160.122.airtelbroadband.in) [122.160.115.90]:49435: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
description:
Jan 30 16:36:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 30 16:36:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.207.195.85
description:
[2025-01-30 16:37:47 +0100] info [webmaild] 94.207.195.85 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-30 16:37:48 dovecot_plain authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:54346: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.205.83
description:
Jan 30 16:37:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.205.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 30 16:37:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-30 16:38:51 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:39793: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.148.129.221
description:
Jan 30 16:38:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.148.129.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.148.129.221
description:
2025-01-30 16:38:56 dovecot_login authenticator failed for hauslan.uk ([127.0.0.1]) [51.148.129.221]:47850: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.206.14
description:
Jan 30 16:38:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.206.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 30 16:38:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.205.83
description:
2025-01-30 16:38:00 dovecot_plain authenticator failed for ([112.164.205.83]) [112.164.205.83]:40769: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
description:
2025-01-30 16:38:39 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:59168: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-30 16:39:06 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:29504: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-30 16:39:31 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:62004: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.111
description:
Jan 30 16:39:48 ait sshd[1029708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.44.78.243
description:
2025-01-30 16:39:03 dovecot_login authenticator failed for ([127.0.0.1]) [38.44.78.243]:53279: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.44.78.243
description:
Jan 30 16:39:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.44.78.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Jan 30 16:39:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-01-30 16:39:24 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:33609: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 30 16:39:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.137.21
description:
Jan 30 16:39:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.137.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.137.21
description:
2025-01-30 16:39:39 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:57836: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.80.12
description:
[2025-01-30 16:39:40 +0100] info [webmaild] 37.239.80.12 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.111
description:
Jan 30 16:39:48 ait sshd[1029708]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 30 16:39:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.62.3
description:
Jan 30 16:39:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.62.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.62.3
description:
2025-01-30 16:39:51 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:52470: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.111
description:
Jan 30 16:40:01 ait sshd[1029807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.111  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.100.31
description:
[2025-01-30 16:40:57 +0100] info [webmaild] 187.19.100.31 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-30 16:40:06 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:40772: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.111
description:
Jan 30 16:40:01 ait sshd[1029807]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 30 16:40:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 199.189.224.233
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-41.199.189.224.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-30 16:41:53 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:44466: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-01-30 16:41:55 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:55309: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-41.147.135.223.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 16:40:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 208.113.236.250
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-41.208.113.236.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Jan 30 16:41:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.159.139.135
description:
2025-01-30 16:41:34 dovecot_login authenticator failed for ([127.0.0.1]) [67.159.139.135]:35476: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-01-30 16:41:42 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:41136: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 30 16:41:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Jan 30 16:41:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:16-41.103.249.112.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.159.139.135
description:
Jan 30 16:41:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.159.139.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.66.151.154
description:
Jan 30 16:42:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.66.151.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.66.151.154
description:
2025-01-30 16:42:05 dovecot_plain authenticator failed for 154.151-66-87.adsl-dyn.isp.belgacom.be [87.66.151.154]:51432: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.232.110.60
description:
[2025-01-30 16:42:19 +0100] info [webmaild] 91.232.110.60 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 30 16:42:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-30 16:42:48 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:43188: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-30 16:43:42 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:52224: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.84.125
description:
2025-01-30 16:43:54 dovecot_login authenticator failed for d4-50-125-84.nap.wideopenwest.com [50.4.84.125]:43832: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
description:
2025-01-30 16:43:57 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:52589: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 30 16:43:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 30 16:43:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-30 16:43:40 dovecot_login authenticator failed for ([211.57.111.99]) [211.57.111.99]:60542: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.4.84.125
description:
Jan 30 16:43:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.4.84.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-30 16:43:41 dovecot_login authenticator failed for ([175.210.74.19]) [175.210.74.19]:39574: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 30 16:43:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.229.201
description:
Jan 30 16:43:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.229.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 30 16:43:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.138.48
description:
[2025-01-30 16:43:09 +0100] info [webmaild] 170.150.138.48 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-30 16:43:10 dovecot_login authenticator failed for ([59.4.255.205]) [59.4.255.205]:57851: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 30 16:43:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-30 16:44:19 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:47919: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.202.241
description:
Jan 30 16:44:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.202.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
description:
2025-01-30 16:44:45 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:39278: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 30 16:44:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.141.174.154
description:
[2025-01-30 16:44:33 +0100] info [webmaild] 103.141.174.154 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
description:
2025-01-30 16:44:58 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:65095: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.229.201
description:
2025-01-30 16:44:00 dovecot_login authenticator failed for s201-229-68-64.ssvec.az.wi-power.com [64.68.229.201]:44356: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-30 16:44:05 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:56826: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 30 16:44:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
description:
Jan 30 16:44:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.194.28
description:
Jan 30 16:45:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.194.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.84.65.182
description:
Jan 30 16:45:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.84.65.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.65.227
description:
2025-01-30 16:45:39 dovecot_login authenticator failed for ([121.147.65.227]) [121.147.65.227]:50806: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 30 16:45:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-01-30 16:45:49 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:23200: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.194.28
description:
2025-01-30 16:45:23 dovecot_login authenticator failed for ([127.0.0.1]) [94.204.194.28]:58890: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-45.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 30 16:45:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.65.227
description:
Jan 30 16:45:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.65.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-30 16:45:43 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:55118: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 30 16:45:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 30 16:45:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-30 16:45:13 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (defing) [94.45.76.149]:36379: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.19.166.113
description:
[2025-01-30 16:45:28 +0100] info [webmaild] 149.19.166.113 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-30 16:45:36 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:46806: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 30 16:45:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.84.65.182
description:
2025-01-30 16:45:47 dovecot_login authenticator failed for ([127.0.0.1]) [151.84.65.182]:39485: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-30 16:45:48 dovecot_login authenticator failed for ([2.57.219.14]) [2.57.219.2]:46816: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.208.64
description:
[2025-01-30 16:46:31 +0100] info [webmaild] 138.204.208.64 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-30 16:46:43 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:63032: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.67.121.58
description:
Jan 30 16:47:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.67.121.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 30 16:46:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.162.59
description:
2025-01-30 16:46:05 dovecot_login authenticator failed for (223-197-162-59.static.imsbiz.com) [223.197.162.59]:57765: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-30 16:46:14 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:36596: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
description:
2025-01-30 16:46:17 dovecot_login authenticator failed for (user-static-94-254-244-211.mobile.play-internet.pl) [94.254.244.211]:60149: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.203.158
description:
2025-01-30 16:46:26 dovecot_plain authenticator failed for ([211.46.203.158]) [211.46.203.158]:60764: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.254.244.211
description:
Jan 30 16:46:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.254.244.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 30 16:46:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.203.158
description:
Jan 30 16:46:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.203.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 30 16:46:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Jan 30 16:46:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.162.59
description:
Jan 30 16:46:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.162.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 16:46:03 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:56537: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-01-30 16:46:03 dovecot_login authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:40980: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 30 16:47:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-30 16:47:21 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:45416: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
description:
2025-01-30 16:47:02 dovecot_login authenticator failed for ([124.67.121.58]) [124.67.121.58]:34269: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 16:47:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-30 16:47:41 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:53656: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 30 16:47:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 30 16:47:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.61.54.114
description:
[2025-01-30 16:47:20 +0100] info [webmaild] 190.61.54.114 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 16:47:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-30 16:47:52 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:41468: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.90.176.235
description:
[2025-01-30 16:48:48 +0100] info [webmaild] 41.90.176.235 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.250.192
description:
[2025-01-30 16:48:50 +0100] info [webmaild] 45.183.250.192 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Jan 30 16:49:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-01-30 16:50:00 dovecot_login authenticator failed for ([60.173.114.254]) [60.173.114.254]:34571: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 30 16:49:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-30 16:49:32 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:36134: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 30 16:49:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.199
description:
[2025-01-30 16:49:43 +0100] info [webmaild] 213.230.86.199 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 16:49:45 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2162: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.21.235.162
description:
Jan 30 16:50:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.21.235.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Jan 30 16:50:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-30 16:50:20 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:55763: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Jan 30 16:50:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 30 16:50:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.216.72
description:
Jan 30 16:50:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.216.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
description:
2025-01-30 16:50:44 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:45259: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 30 16:50:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.35.75.163
description:
[2025-01-30 16:50:26 +0100] info [webmaild] 177.35.75.163 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-30 16:50:30 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:33602: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 30 16:50:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
description:
Jan 30 16:50:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 30 16:50:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.216.72
description:
2025-01-30 16:50:43 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:37169: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-30 16:50:58 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.138]:39424: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-01-30 16:50:14 dovecot_plain authenticator failed for (200151009074.userdial.telemar.net.br) [200.151.9.74]:57028: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-01-30 16:50:26 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:40488: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-30 16:50:39 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:60220: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
description:
2025-01-30 16:50:52 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:52024: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 30 16:51:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-30 16:51:29 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:57026: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-30 16:51:41 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:39556: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-30 16:51:42 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:57696: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.235.98
description:
Jan 30 16:51:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.235.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.235.98
description:
2025-01-30 16:51:46 dovecot_login authenticator failed for ([117.253.235.98]) [117.253.235.98]:41598: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Jan 30 16:51:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-01-30 16:51:51 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:60908: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
description:
Jan 30 16:51:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
description:
2025-01-30 16:51:55 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:49531: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 16:51:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.43.245.117
description:
[2025-01-30 16:51:15 +0100] info [webmaild] 31.43.245.117 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 30 16:51:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 30 16:51:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Jan 30 16:52:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.173.173.60
description:
Jan 30 16:52:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.173.173.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-30 16:52:26 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:55209: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.173.173.60
description:
2025-01-30 16:52:27 dovecot_login authenticator failed for ([178.173.173.60]) [178.173.173.60]:38124: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 30 16:52:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-30 16:52:08 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:40470: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 30 16:52:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 30 16:52:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.149.185
description:
Jan 30 16:52:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.149.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.149.185
description:
2025-01-30 16:52:15 dovecot_plain authenticator failed for ([120.237.149.185]) [120.237.149.185]:12374: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-01-30 16:52:22 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:41362: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-30 16:52:39 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:8991: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.74.166
description:
[2025-01-30 16:53:00 +0100] info [webmaild] 191.99.74.166 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.115.119
description:
2025-01-30 16:53:24 dovecot_plain authenticator failed for (conata.static.gvt.net.br) [177.43.115.119]:56500: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.171
description:
Jan 30 16:53:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
description:
2025-01-30 16:53:29 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:48939: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Jan 30 16:53:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-01-30 16:53:50 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:50946: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 30 16:54:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.173.4
description:
[2025-01-30 16:54:00 +0100] info [webmaild] 181.115.173.4 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-01-30 16:54:48 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:56353: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 30 16:54:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-30 16:54:02 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:42026: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
description:
2025-01-30 16:54:18 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:64661: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-30 16:54:34 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:53532: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.173.173.60
description:
2025-01-30 16:54:40 dovecot_login authenticator failed for ([178.173.173.60]) [178.173.173.60]:40925: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-30 16:54:54 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:45526: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 30 16:54:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
description:
Jan 30 16:54:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.237.73
description:
[2025-01-30 16:54:33 +0100] info [webmaild] 190.97.237.73 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 30 16:54:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.173.173.60
description:
Jan 30 16:54:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.173.173.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Jan 30 16:54:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-30 16:54:52 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:49390: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 30 16:55:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-30 16:55:41 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:37986: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 30 16:55:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-30 16:55:11 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:43860: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.22.124
description:
2025-01-30 16:55:30 dovecot_login authenticator failed for ([94.207.22.124]) [94.207.22.124]:39536: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-30 16:55:43 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:54079: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Jan 30 16:55:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Jan 30 16:55:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.214.101.46
description:
[2025-01-30 16:55:27 +0100] info [webmaild] 105.214.101.46 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.220.194.137
description:
[2025-01-30 16:55:20 +0100] info [cpaneld] 77.220.194.137 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.22.124
description:
Jan 30 16:55:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.22.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 30 16:55:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 30 16:55:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-01-30 16:55:12 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:39107: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-30 16:55:49 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:40076: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-01-30 16:55:02 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:43497: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 16:55:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 30 16:55:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.135.6.10
description:
Jan 30 16:56:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.135.6.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 16:56:38 ait sshd[1038299]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 16:56:38 ait sshd[1038299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
description:
2025-01-30 16:56:05 dovecot_plain authenticator failed for ([178.178.194.135]) [178.178.194.135]:45724: 535 Incorrect authentication data (set_id=klah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-56.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
description:
Jan 30 16:56:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
description:
2025-01-30 16:56:22 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:54778: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Jan 30 16:56:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-01-30 16:56:00 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:58513: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-30 16:56:02 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:40544: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
description:
2025-01-30 16:57:04 dovecot_login authenticator failed for ([127.0.0.1]) [2.192.20.166]:47784: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 30 16:57:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-30 16:57:13 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:38016: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.130.180.255
description:
[2025-01-30 16:57:30 +0100] info [webmaild] 177.130.180.255 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
description:
Jan 30 16:57:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.57.33.221
description:
Jan 30 16:57:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.57.33.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
description:
2025-01-30 16:57:14 dovecot_login authenticator failed for ([127.0.0.1]) [120.57.33.221]:52582: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 30 16:58:45 ait sshd[1039217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-30 16:58:58 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:40003: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 30 16:58:45 ait sshd[1039217]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 30 16:58:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.147.85
description:
[2025-01-30 16:58:27 +0100] info [webmaild] 170.84.147.85 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-30 16:58:44 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:40186: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.152.26
description:
2025-01-30 16:58:08 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.152.26]:41305: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.147.136.221
description:
Jan 30 16:58:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.147.136.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.147.136.221
description:
2025-01-30 16:58:15 dovecot_login authenticator failed for net-93-147-136-221.cust.vodafonedsl.it ([127.0.0.1]) [93.147.136.221]:37242: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.82.38
description:
[2025-01-30 16:58:50 +0100] info [webmaild] 187.62.82.38 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.152.26
description:
Jan 30 16:58:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.152.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.229.86.222
description:
2025-01-30 16:58:35 dovecot_plain authenticator failed for 216-229-86-222.fidnet.com [216.229.86.222]:60831: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 30 16:58:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 30 16:59:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 30 16:59:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 30 16:59:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 16:59:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-30 16:59:54 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:50715: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-30 16:59:11 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:58802: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 30 16:59:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-30 16:59:24 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:36725: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.147.123.239
description:
[2025-01-30 16:59:41 +0100] info [webmaild] 197.147.123.239 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 16:59:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-30 16:59:10 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:52334: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 16:59:12 dovecot_plain authenticator failed for ([207.188.157.230]) [207.188.157.230]:30609: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.226.68.250
description:
2025-01-30 17:00:19 dovecot_login authenticator failed for syn-072-226-068-250.res.spectrum.com [72.226.68.250]:51182: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 17:00:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-30 17:00:55 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:37923: 535 Incorrect authentication data (set_id=ads21b00172y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 30 17:00:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-30 17:00:05 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:44150: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.226.68.250
description:
Jan 30 17:00:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.226.68.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-30 17:00:37 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:47591: 535 Incorrect authentication data (set_id=ads21b00172y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.179.142
description:
Jan 30 17:00:40 ait sshd[1040179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.179.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 30 17:00:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 30 17:00:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-30 17:00:06 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:56908: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 30 17:00:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
description:
Jan 30 17:01:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.186.174.166
description:
2025-01-30 17:01:26 dovecot_plain authenticator failed for (138-186-174-166.redebandalarga.net.br) [138.186.174.166]:41630: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.5.103
description:
[2025-01-30 17:01:51 +0100] info [webmaild] 45.161.5.103 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
description:
2025-01-30 17:01:17 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:32903: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.174.166
description:
Jan 30 17:01:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.174.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 17:01:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 30 17:01:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-30 17:01:57 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:54193: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 30 17:02:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 30 17:02:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 30 17:02:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Jan 30 17:02:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 30 17:02:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
description:
2025-01-30 17:02:20 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:41964: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 30 17:02:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
description:
Jan 30 17:02:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 30 17:02:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
description:
Jan 30 17:02:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
description:
2025-01-30 17:02:16 dovecot_plain authenticator failed for ([183.98.215.147]) [183.98.215.147]:6793: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-30 17:02:19 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:53806: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.242.122
description:
Jan 30 17:02:22 ait sshd[1041080]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.207.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
description:
Jan 30 17:02:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-30 17:02:41 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:12475: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-30 17:02:05 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:46619: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
description:
2025-01-30 17:02:06 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:55314: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 17:02:15 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:3322: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
description:
Jan 30 17:02:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.207.242.122
description:
Jan 30 17:02:22 ait sshd[1041080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.207.242.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
description:
2025-01-30 17:02:40 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:61267: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-30 17:02:52 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:51838: 535 Incorrect authentication data (set_id=gyn)


