# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-27 06:10:53 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:38954: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Jan 27 06:11:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-01-27 06:11:37 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:33412: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 27 06:10:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-01-27 06:11:07 dovecot_plain authenticator failed for (trartigely) [41.248.243.181]:46806: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-01-27 06:11:40 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:53785: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.131.42.243
description:
[2025-01-27 06:10:50 +0100] info [webmaild] 37.131.42.243 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.248.251
description:
Jan 27 06:11:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.248.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
description:
Jan 27 06:11:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Jan 27 06:11:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.229.187
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:shedatowusua1234@gmail.com||WPU:shedatowusua1234@gmail.com||RSV:6.65||T:APACHE||MV:06-11.173.212.229.187


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.248.251
description:
2025-01-27 06:11:04 dovecot_plain authenticator failed for c188-148-248-251.bredband.tele2.se (stilatioma) [188.148.248.251]:52006: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Jan 27 06:11:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
description:
2025-01-27 06:11:05 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:50672: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.135.146
description:
[2025-01-27 06:11:26 +0100] info [webmaild] 160.238.135.146 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Jan 27 06:11:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Jan 27 06:12:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.102.90
description:
Jan 27 06:12:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.102.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 27 06:12:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Jan 27 06:11:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 27 06:11:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-01-27 06:11:49 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:57808: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
description:
2025-01-27 06:12:14 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:38226: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-27 06:12:29 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:42242: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-27 06:11:52 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:51132: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-01-27 06:11:55 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:36966: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-01-27 06:12:06 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:49193: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-01-27 06:13:09 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:56263: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
description:
2025-01-27 06:13:40 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:58834: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
description:
Jan 27 06:13:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-27 06:13:40 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:59468: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.63.209.113
description:
Jan 27 06:12:59 ait sshd[2691532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.63.209.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Jan 27 06:13:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Jan 27 06:13:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 27 06:13:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.111.161.237
description:
[2025-01-27 06:12:53 +0100] info [webmaild] 187.111.161.237 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.178
description:
Jan 27 06:12:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.178 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.63.209.113
description:
Jan 27 06:13:00 ait sshd[2691532]: Failed password for invalid user user1 from 59.63.209.113 port 60486 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 27 06:13:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-27 06:13:11 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:32457: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.63.209.113
description:
Jan 27 06:12:59 ait sshd[2691532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.63.209.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.178
description:
2025-01-27 06:12:59 dovecot_plain authenticator failed for 83-233-71-178.cust.bredband2.com [83.233.71.178]:39966: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.39.139.53
description:
[2025-01-27 06:13:30 +0100] info [webmaild] 181.39.139.53 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-01-27 06:13:30 dovecot_plain authenticator failed for ([195.222.57.182]) [195.222.57.190]:43842: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 27 06:14:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Jan 27 06:14:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.216
description:
Jan 27 06:14:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.215
description:
2025-01-27 06:14:38 dovecot_login authenticator failed for ([195.178.110.215]) [195.178.110.215]:60181: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
description:
2025-01-27 06:14:16 dovecot_plain authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:42704: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-01-27 06:14:17 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:51576: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.215
description:
Jan 27 06:14:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-27 06:14:44 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:59580: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
description:
Jan 27 06:13:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-27 06:14:07 dovecot_plain authenticator failed for (exced) [164.92.243.206]:51860: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.58.224
description:
[2025-01-27 06:14:01 +0100] info [webmaild] 168.232.58.224 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.162.59
description:
Jan 27 06:14:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.162.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-27 06:13:46 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:48304: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 27 06:14:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.167.139
description:
2025-01-27 06:14:26 dovecot_plain authenticator failed for (abts-kk-static-139.167.166.122.airtelbroadband.in) [122.166.167.139]:47260: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 27 06:13:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
description:
Jan 27 06:14:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 27 06:14:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.167.139
description:
Jan 27 06:14:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.167.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.162.59
description:
2025-01-27 06:14:43 dovecot_login authenticator failed for (223-197-162-59.static.imsbiz.com) [223.197.162.59]:58196: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-27 06:14:44 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:57368: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.31
description:
Jan 27 06:13:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
description:
2025-01-27 06:13:51 dovecot_plain authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:43757: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
description:
2025-01-27 06:13:54 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:47001: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.216
description:
2025-01-27 06:14:25 dovecot_login authenticator failed for ([195.178.110.216]) [195.178.110.216]:55902: 535 Incorrect authentication data (set_id=scanner)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.197.191.145
description:
[2025-01-27 06:15:25 +0100] info [webmaild] 179.197.191.145 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Jan 27 06:14:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-01-27 06:14:49 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:60580: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 27 06:14:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-27 06:14:57 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:33181: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.204.23
description:
Jan 27 06:15:03 ait sshd[2692198]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.204.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
description:
2025-01-27 06:14:59 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:39790: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.204.23
description:
Jan 27 06:15:03 ait sshd[2692198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.204.23


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 27 06:15:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 06:15:32 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (metic) [51.255.84.180]:56378: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-27 06:15:40 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:57430: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.104.9
description:
Jan 27 06:15:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.104.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
description:
Jan 27 06:14:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
description:
Jan 27 06:14:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-01-27 06:14:59 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:38224: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 06:15:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 27 06:15:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.127.205.91
description:
Jan 27 06:16:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.127.205.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.46
description:
Jan 27 06:16:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.11.11.58
description:
Jan 27 06:16:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.11.11.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.11.58
description:
2025-01-27 06:16:34 dovecot_plain authenticator failed for ([59.11.11.58]) [59.11.11.58]:43249: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
description:
2025-01-27 06:15:52 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:36360: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.82.122.234
description:
Jan 27 06:16:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.82.122.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.82.122.234
description:
2025-01-27 06:16:21 dovecot_plain authenticator failed for (static.ftth.bgl.59.93.107.33.bsnl.in) [119.82.122.234]:44960: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.104.9
description:
2025-01-27 06:15:46 dovecot_plain authenticator failed for ([183.237.104.9]) [183.237.104.9]:60914: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Jan 27 06:15:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 27 06:15:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
description:
2025-01-27 06:15:57 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:36686: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 27 06:15:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
description:
Jan 27 06:15:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-27 06:15:56 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:52643: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.46
description:
2025-01-27 06:16:16 dovecot_login authenticator failed for ([104.241.236.46]) [104.241.236.46]:33884: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-27 06:16:47 dovecot_login authenticator failed for ([223.26.225.129]) [210.206.24.234]:54393: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-27 06:17:27 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:44144: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
description:
2025-01-27 06:17:29 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:53250: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
description:
2025-01-27 06:17:16 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:8499: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 27 06:16:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.170.189.164
description:
Jan 27 06:16:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.170.189.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
description:
Jan 27 06:16:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-01-27 06:16:58 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:59720: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.170.189.164
description:
2025-01-27 06:16:58 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:57948: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
description:
Jan 27 06:17:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Jan 27 06:17:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-01-27 06:17:16 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:39536: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 27 06:17:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
description:
Jan 27 06:17:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-27 06:17:41 dovecot_login authenticator failed for ([50.99.36.130]) [50.99.36.130]:53358: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 27 06:17:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.204.23
description:
Jan 27 06:18:38 ait sshd[2693768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.204.23


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 06:17:53 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:52964: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 06:18:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Jan 27 06:18:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-01-27 06:18:30 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:51150: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 06:18:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
description:
2025-01-27 06:18:32 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:44863: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-27 06:18:41 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:58446: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 27 06:18:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.252.75
description:
[2025-01-27 06:17:47 +0100] info [webmaild] 170.244.252.75 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 06:17:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.204.23
description:
Jan 27 06:18:38 ait sshd[2693768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.204.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 27 06:18:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
description:
Jan 27 06:18:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.154.54.238
description:
[2025-01-27 06:17:46 +0100] info [webmaild] 190.154.54.238 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 06:18:08 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:39222: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Jan 27 06:18:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-01-27 06:18:20 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:52646: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 06:19:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-01-27 06:19:10 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:35018: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-01-27 06:19:28 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:50954: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.241.133
description:
2025-01-27 06:19:30 dovecot_plain authenticator failed for ([223.82.241.133]) [223.82.241.133]:52092: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.242.129
description:
2025-01-27 06:19:07 dovecot_plain authenticator failed for (peglot) [65.20.242.129]:34506: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
description:
Jan 27 06:19:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.149.10
description:
2025-01-27 06:18:56 dovecot_plain authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:34525: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.242.129
description:
Jan 27 06:19:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.242.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 06:19:08 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:50746: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Jan 27 06:19:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.82.241.133
description:
Jan 27 06:19:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.82.241.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 27 06:18:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
description:
2025-01-27 06:19:34 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:59792: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 27 06:19:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-27 06:19:13 dovecot_plain authenticator failed for (prowed) [109.108.95.66]:32936: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 06:18:45 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:47123: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Jan 27 06:19:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.149.10
description:
Jan 27 06:18:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.149.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Jan 27 06:19:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Jan 27 06:19:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-01-27 06:19:12 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:60395: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-01-27 06:19:19 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:55998: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-27 06:18:53 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:32276: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
description:
Jan 27 06:19:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-01-27 06:19:18 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br [186.247.192.94]:60942: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 27 06:19:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-27 06:20:41 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:18030: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.174.166
description:
Jan 27 06:19:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.174.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.254.244.211
description:
Jan 27 06:19:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.254.244.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 27 06:20:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Jan 27 06:20:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-01-27 06:20:17 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:37786: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-27 06:20:21 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:32882: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.247.249.10
description:
Jan 27 06:20:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.247.249.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 27 06:19:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
description:
2025-01-27 06:19:59 dovecot_login authenticator failed for (user-static-94-254-244-211.mobile.play-internet.pl) [94.254.244.211]:43078: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
description:
2025-01-27 06:20:03 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:50053: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.110.62.5
description:
2025-01-27 06:20:05 dovecot_plain authenticator failed for ([180.110.62.5]) [180.110.62.5]:58225: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-27 06:20:16 dovecot_plain authenticator failed for ([220.90.239.158]) [220.90.239.158]:44041: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 06:20:32 ait sshd[2694513]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-27 06:20:00 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:54556: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 27 06:20:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 06:20:32 ait sshd[2694513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Jan 27 06:20:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 27 06:20:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-27 06:20:41 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:54230: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 27 06:20:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
description:
Jan 27 06:20:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-01-27 06:20:43 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:47055: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 27 06:20:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-27 06:19:52 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:50869: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 27 06:19:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.110.62.5
description:
Jan 27 06:20:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.110.62.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.74.251.177
description:
Jan 27 06:20:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.74.251.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
description:
Jan 27 06:20:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
description:
2025-01-27 06:20:31 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:57802: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-01-27 06:20:36 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:54301: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-27 06:19:43 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:59373: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 27 06:19:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.186.174.166
description:
2025-01-27 06:19:54 dovecot_plain authenticator failed for (138-186-174-166.redebandalarga.net.br) [138.186.174.166]:46249: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-27 06:20:05 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:59768: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 27 06:20:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.251.177
description:
2025-01-27 06:20:29 dovecot_plain authenticator failed for ([27.74.251.177]) [27.74.251.177]:42158: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Jan 27 06:20:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-27 06:20:43 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:41348: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-27 06:19:54 dovecot_plain authenticator failed for (hally) [93.159.152.6]:42022: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.247.249.10
description:
2025-01-27 06:20:29 dovecot_login authenticator failed for ([61.247.249.10]) [61.247.249.10]:57772: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.186
description:
Jan 27 06:21:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
description:
2025-01-27 06:20:47 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:59330: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
description:
2025-01-27 06:21:14 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:51386: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 06:21:28 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:38990: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.46
description:
Jan 27 06:21:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-01-27 06:21:32 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:34441: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.186
description:
2025-01-27 06:21:41 dovecot_login authenticator failed for ([111.61.177.186]) [111.61.177.186]:59380: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Jan 27 06:21:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Jan 27 06:21:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.76
description:
Jan 27 06:21:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.76
description:
2025-01-27 06:21:37 dovecot_login authenticator failed for ([104.241.233.76]) [104.241.233.76]:53180: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
description:
Jan 27 06:20:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-27 06:20:57 dovecot_login authenticator failed for ([183.105.138.168]) [211.35.237.38]:40477: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.26.205.154
description:
2025-01-27 06:20:59 dovecot_plain authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:51453: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.46
description:
2025-01-27 06:21:04 dovecot_login authenticator failed for ([104.241.236.46]) [104.241.236.46]:58192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.26.205.154
description:
Jan 27 06:20:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.26.205.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.127.177.194
description:
Jan 27 06:21:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.127.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 06:20:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.125.62
description:
Jan 27 06:21:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.125.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 27 06:21:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 27 06:20:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.125.62
description:
2025-01-27 06:21:17 dovecot_plain authenticator failed for (abts-mum-static-062.125.70.182.airtelbroadband.in) [182.70.125.62]:55512: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 06:21:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-27 06:21:04 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:49340: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
description:
2025-01-27 06:21:18 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:52410: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 129.122.206.105
description:
[2025-01-27 06:21:52 +0100] info [webmaild] 129.122.206.105 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-27 06:22:27 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:60827: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-01-27 06:21:46 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:34733: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 27 06:21:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.137.112.251
description:
Jan 27 06:21:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.137.112.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.137.112.251
description:
2025-01-27 06:21:54 dovecot_login authenticator failed for (abts-mum-static-007.14.170.122.airtelbroadband.in) [103.137.112.251]:43140: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 18.208.129.174
description:
2025-01-27 06:22:15 dovecot_plain authenticator failed for ec2-18-208-129-174.compute-1.amazonaws.com (EC2AMAZ-LI9NKAF.ec2.internal) [18.208.129.174]:53210: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 27 06:22:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-27 06:21:51 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:53169: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.203.203.208
description:
Jan 27 06:22:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.203.203.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
description:
Jan 27 06:21:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.203.203.208
description:
2025-01-27 06:22:07 dovecot_plain authenticator failed for external-api.facilzap.com.br (fpecy239a0e3he6ugbv) [116.203.203.208]:46896: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 27 06:22:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-27 06:23:41 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:55673: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
description:
2025-01-27 06:22:45 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:49172: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-27 06:22:53 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:50996: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.36.192.207
description:
2025-01-27 06:23:18 dovecot_plain authenticator failed for host-176-36-192-207.b024.la.net.ua [176.36.192.207]:54292: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-01-27 06:23:28 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:43286: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-27 06:23:02 dovecot_login authenticator failed for ([58.240.2.38]) [58.240.2.38]:45727: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.29.232.114
description:
Jan 27 06:23:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.29.232.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.36.192.207
description:
Jan 27 06:23:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.36.192.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 27 06:23:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-27 06:23:21 dovecot_login authenticator failed for ([103.178.158.132]) [103.178.158.132]:39954: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 27 06:23:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-01-27 06:23:11 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:32740: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-27 06:23:21 dovecot_login authenticator failed for ([93.182.160.222]) [93.182.160.222]:34646: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 06:23:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-27 06:22:44 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:50116: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
description:
Jan 27 06:22:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 27 06:23:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 27 06:23:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.148.71
description:
Jan 27 06:23:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.148.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.29.232.114
description:
2025-01-27 06:23:41 dovecot_login authenticator failed for (c20029232-114.consulnetworks.com.co) [200.29.232.114]:45622: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.148.71
description:
2025-01-27 06:23:42 dovecot_plain authenticator failed for broadband-95-84-148-71.ip.moscow.rt.ru [95.84.148.71]:57212: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 27 06:22:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Jan 27 06:23:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Jan 27 06:23:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 27 06:24:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.213
description:
2025-01-27 06:24:19 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:37990: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-27 06:23:50 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:40937: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-27 06:23:52 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:53410: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.213
description:
Jan 27 06:24:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 06:24:27 ait sshd[2695896]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 06:24:27 ait sshd[2695896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Jan 27 06:23:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 27 06:24:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-27 06:24:03 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:59010: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-27 06:24:09 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:64434: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 06:24:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 06:24:22 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:39875: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.229.187
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ruby.y.owusu@gmail.com||WPU:ruby.y.owusu@gmail.com||RSV:6.65||T:APACHE||MV:06-23.173.212.229.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.5
description:
Jan 27 06:23:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 27 06:23:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 27 06:23:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-01-27 06:23:58 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:35732: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-01-27 06:25:05 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:60491: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
description:
Jan 27 06:25:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
description:
2025-01-27 06:25:30 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:53486: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-01-27 06:25:39 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:64196: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Jan 27 06:25:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Jan 27 06:25:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Jan 27 06:25:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-01-27 06:25:41 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:33862: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.229.220.163
description:
[2025-01-27 06:26:50 +0100] info [webmaild] 84.229.220.163 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.199.27
description:
Jan 27 06:27:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.31.135
description:
Jan 27 06:27:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.31.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.31.135
description:
2025-01-27 06:27:06 dovecot_login authenticator failed for 111-70-31-135.emome-ip.hinet.net [111.70.31.135]:56176: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Jan 27 06:27:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.29.204
description:
47.128.29.204 - - [27/Jan/2025:06:26:52 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16829269 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/5ee23d?panel=validator" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.204


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 06:27:13 ait sshd[2697161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 27 06:27:37 ait sshd[2697293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.230.80.34
description:
2025-01-27 06:27:31 dovecot_plain authenticator failed for ([49.231.234.142]) [49.230.80.34]:64866: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.236.170.3
description:
2025-01-27 06:27:34 dovecot_plain authenticator failed for ([4.236.170.3]) [4.236.170.3]:53732: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 06:27:13 ait sshd[2697161]: Invalid user musikschule-deuerling.de 2a01 from 111.231.56.128 port 55688


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-27 06:27:42 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:58571: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 06:26:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 27 06:26:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-27 06:26:56 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:60286: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-01-27 06:27:07 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:49524: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-01-27 06:27:02 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:44151: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.199.27
description:
2025-01-27 06:27:40 dovecot_login authenticator failed for (197-255-199-27.netpagedns.net) [197.255.199.27]:45751: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 06:27:13 ait sshd[2697161]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.230.80.34
description:
Jan 27 06:27:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.230.80.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.236.170.3
description:
Jan 27 06:27:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.236.170.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 27 06:27:37 ait sshd[2697293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.51.28.60
description:
Jan 27 06:26:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.51.28.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.51.28.60
description:
2025-01-27 06:26:49 dovecot_plain authenticator failed for (123-51-28-60.static.dsl.net.au) [123.51.28.60]:32944: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Jan 27 06:27:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 27 06:27:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
description:
Jan 27 06:28:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-01-27 06:28:17 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:45909: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-27 06:28:19 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:39052: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.189.42
description:
Jan 27 06:28:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.189.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.195.104
description:
Jan 27 06:27:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.189.42
description:
2025-01-27 06:28:22 dovecot_plain authenticator failed for (82-102-189-42.orange.net.il) [82.102.189.42]:38768: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 27 06:28:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.124.152
description:
2025-01-27 06:28:13 dovecot_plain authenticator failed for ([94.207.124.152]) [94.207.124.152]:45911: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 27 06:27:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.195.104
description:
2025-01-27 06:27:59 dovecot_plain authenticator failed for ([103.187.195.104]) [103.187.195.104]:33034: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Jan 27 06:28:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 27 06:28:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
description:
2025-01-27 06:28:16 dovecot_plain authenticator failed for ([194.85.69.22]) [194.85.69.22]:53552: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.247
description:
Jan 27 06:27:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.247
description:
2025-01-27 06:27:45 dovecot_plain authenticator failed for ([221.149.233.247]) [221.149.233.247]:34473: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-27 06:28:01 dovecot_login authenticator failed for ([222.160.227.134]) [222.160.227.134]:48928: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
description:
2025-01-27 06:28:03 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:55159: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.124.152
description:
Jan 27 06:28:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.124.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-01-27 06:29:19 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:47414: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 27 06:29:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-01-27 06:29:34 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1798: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
description:
Jan 27 06:29:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Jan 27 06:29:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.125.64.126
description:
Jan 27 06:29:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.125.64.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.165.222
description:
Jan 27 06:29:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
description:
2025-01-27 06:29:12 dovecot_plain authenticator failed for ([47.206.63.169]) [47.206.63.169]:55576: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-01-27 06:29:14 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:52042: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Jan 27 06:29:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 27 06:29:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.188.143
description:
[2025-01-27 06:28:48 +0100] info [webmaild] 177.38.188.143 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.125.64.126
description:
2025-01-27 06:29:20 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:55808: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-27 06:29:30 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:30605: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Jan 27 06:29:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.165.222
description:
2025-01-27 06:29:40 dovecot_plain authenticator failed for ([183.247.165.222]) [183.247.165.222]:32852: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-27 06:29:47 dovecot_login authenticator failed for ([103.178.158.133]) [103.178.158.132]:35458: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 27 06:29:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-01-27 06:30:03 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:39988: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Jan 27 06:30:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 27 06:29:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-01-27 06:30:06 dovecot_plain authenticator failed for ([60.173.114.254]) [60.173.114.254]:40408: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.254.71
description:
Jan 27 06:30:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.254.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.150.213.239
description:
Jan 27 06:30:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.150.213.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.41.69.130
description:
2025-01-27 06:30:37 dovecot_login authenticator failed for syn-047-041-069-130.res.spectrum.com [47.41.69.130]:53211: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 27 06:29:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-27 06:29:51 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:52068: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Jan 27 06:30:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
description:
Jan 27 06:30:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-01-27 06:30:10 dovecot_plain authenticator failed for ([164.164.117.23]) [164.164.117.23]:45072: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-27 06:29:59 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:50352: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.254.71
description:
2025-01-27 06:30:28 dovecot_plain authenticator failed for (steroust) [89.175.254.71]:49398: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.41.69.130
description:
Jan 27 06:30:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.41.69.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.213.239
description:
2025-01-27 06:30:34 dovecot_plain authenticator failed for ([103.150.213.239]) [103.150.213.239]:40495: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-27 06:31:10 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:37282: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.189.42
description:
2025-01-27 06:31:16 dovecot_plain authenticator failed for ([82.102.189.42]) [82.102.189.42]:40904: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-27 06:30:50 dovecot_plain authenticator failed for (sclerowy) [81.211.77.58]:5368: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
description:
Jan 27 06:31:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
description:
2025-01-27 06:31:09 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:38500: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-31.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.201.53
description:
Jan 27 06:31:34 ait sshd[2698840]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.227.201.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.227.201.53
description:
Jan 27 06:31:34 ait sshd[2698840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.227.201.53


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 27 06:30:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-27 06:30:48 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:40419: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
description:
Jan 27 06:30:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.242
description:
Jan 27 06:31:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 27 06:31:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.189.42
description:
Jan 27 06:31:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.189.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Jan 27 06:31:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-01-27 06:31:05 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:9907: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-27 06:31:13 +0100] info [whostmgrd] 212.227.201.53 - (iric.usadministratorindex.php) "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
description:
2025-01-27 06:31:24 dovecot_login authenticator failed for ([111.61.176.242]) [111.61.176.242]:22792: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 27 06:30:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
description:
2025-01-27 06:31:00 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:43394: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.189
description:
Jan 27 06:31:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
description:
2025-01-27 06:31:49 dovecot_plain authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:50472: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-27 06:31:50 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:56327: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-01-27 06:31:57 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:51132: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.225
description:
2025-01-27 06:31:57 dovecot_plain authenticator failed for 83-233-71-225.cust.bredband2.com [83.233.71.225]:36780: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
description:
Jan 27 06:32:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.160.175
description:
Jan 27 06:31:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.160.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 27 06:31:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Jan 27 06:31:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 06:32:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-27 06:32:23 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:49632: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-01-27 06:32:38 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:44398: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.189
description:
2025-01-27 06:31:48 dovecot_plain authenticator failed for (ellith) [65.20.147.189]:51395: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.225
description:
Jan 27 06:31:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-27 06:32:12 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:13844: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 27 06:31:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
description:
2025-01-27 06:31:59 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:47021: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 27 06:32:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-27 06:32:08 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:55174: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 27 06:32:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
description:
2025-01-27 06:32:26 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:40167: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Jan 27 06:32:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
description:
2025-01-27 06:33:31 dovecot_login authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:37277: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 06:33:42 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:51708: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.167.25
description:
Jan 27 06:32:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.167.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-01-27 06:32:55 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:53650: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 99.216.83.141
description:
Jan 27 06:33:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 99.216.83.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
description:
2025-01-27 06:33:38 dovecot_plain authenticator failed for ([103.190.91.99]) [103.190.91.99]:52955: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 06:33:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.167.25
description:
2025-01-27 06:32:48 dovecot_plain authenticator failed for ([187.95.167.25]) [187.95.167.25]:52299: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.212
description:
Jan 27 06:33:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 06:33:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.99
description:
Jan 27 06:33:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Jan 27 06:32:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.216.83.141
description:
2025-01-27 06:33:08 dovecot_login authenticator failed for ([99.216.83.141]) [99.216.83.141]:51308: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.225.125.23
description:
[2025-01-27 06:33:16 +0100] info [webmaild] 45.225.125.23 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
description:
Jan 27 06:33:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.212
description:
2025-01-27 06:33:07 dovecot_login authenticator failed for ([195.178.110.212]) [195.178.110.212]:63680: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.50.125
description:
Jan 27 06:33:26 ait sshd[2699572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.50.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.50.125
description:
Jan 27 06:33:26 ait sshd[2699572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.50.125  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.153.49
description:
Jan 27 06:32:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.153.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
description:
2025-01-27 06:32:47 dovecot_plain authenticator failed for ([221.2.153.49]) [221.2.153.49]:41985: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 27 06:32:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-27 06:32:54 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:43020: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-27 06:34:01 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:46704: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
description:
2025-01-27 06:34:12 dovecot_plain authenticator failed for ([220.172.203.43]) [220.172.203.43]:36697: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Jan 27 06:34:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.47.82.30
description:
2025-01-27 06:34:35 dovecot_plain authenticator failed for (30-82-47.185.prisme-network.com) [185.47.82.30]:38306: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-01-27 06:34:39 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:56621: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 27 06:33:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
description:
Jan 27 06:34:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-27 06:34:15 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:53822: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.150.213.239
description:
Jan 27 06:34:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.150.213.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-01-27 06:33:51 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:55066: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.83.138.102
description:
2025-01-27 06:33:57 dovecot_login authenticator failed for ([223.83.138.102]) [223.83.138.102]:55727: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
description:
Jan 27 06:34:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.213.239
description:
2025-01-27 06:34:25 dovecot_plain authenticator failed for ([103.150.213.239]) [103.150.213.239]:42293: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-27 06:34:28 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:56090: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.30.14.122
description:
2025-01-27 06:34:29 dovecot_plain authenticator failed for ([185.30.14.122]) [185.30.14.122]:45721: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Jan 27 06:33:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-27 06:33:51 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:34061: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
description:
2025-01-27 06:34:16 dovecot_login authenticator failed for ([219.157.124.84]) [219.157.124.84]:53618: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.203.43
description:
Jan 27 06:34:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.203.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
description:
2025-01-27 06:34:27 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:36364: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-01-27 06:34:22 dovecot_login authenticator failed for ([50.224.22.135]) [50.224.22.135]:52513: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
description:
Jan 27 06:33:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.83.138.102
description:
Jan 27 06:33:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.83.138.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
description:
2025-01-27 06:33:55 dovecot_plain authenticator failed for (nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:37024: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Jan 27 06:34:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 27 06:34:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 27 06:34:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.82.30
description:
Jan 27 06:34:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.82.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Jan 27 06:33:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.14.122
description:
Jan 27 06:34:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.114.36
description:
Jan 27 06:34:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.114.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.186.174.166
description:
2025-01-27 06:35:32 dovecot_plain authenticator failed for (138-186-174-166.redebandalarga.net.br) [138.186.174.166]:33928: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
description:
Jan 27 06:35:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
description:
2025-01-27 06:35:35 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:46579: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-01-27 06:34:53 dovecot_login authenticator failed for ([223.71.98.202]) [223.71.98.202]:34645: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-01-27 06:35:00 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:34928: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.117.148.96
description:
[2025-01-27 06:34:50 +0100] info [webmaild] 185.117.148.96 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Jan 27 06:34:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.102.84
description:
[2025-01-27 06:35:03 +0100] info [webmaild] 190.89.102.84 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 27 06:35:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.114.36
description:
2025-01-27 06:34:44 dovecot_login authenticator failed for ([58.16.114.36]) [58.16.114.36]:44333: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Jan 27 06:34:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-27 06:35:07 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:31289: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-27 06:35:08 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:56193: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.174.166
description:
Jan 27 06:35:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.174.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 27 06:35:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.147
description:
2025-01-27 06:36:26 dovecot_login authenticator failed for (m121-202-198-147.smartone.com) [121.202.198.147]:61314: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.135.86
description:
[2025-01-27 06:36:06 +0100] info [webmaild] 157.100.135.86 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.209
description:
Jan 27 06:36:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.6.229
description:
[2025-01-27 06:36:20 +0100] info [webmaild] 138.97.6.229 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
description:
2025-01-27 06:36:24 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:47500: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 06:36:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.72.242.136
description:
Jan 27 06:36:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.72.242.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.72.242.136
description:
2025-01-27 06:36:34 dovecot_plain authenticator failed for ([206.72.242.136]) [206.72.242.136]:41351: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 27 06:35:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.101.117
description:
Jan 27 06:36:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.101.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.209
description:
2025-01-27 06:36:20 dovecot_login authenticator failed for ([195.178.110.209]) [195.178.110.209]:50135: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
description:
Jan 27 06:36:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.147
description:
Jan 27 06:36:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Jan 27 06:35:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-01-27 06:35:51 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:33909: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-27 06:35:56 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:38964: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.37.101.117
description:
2025-01-27 06:36:11 dovecot_login authenticator failed for ([104.37.101.117]) [104.37.101.117]:54627: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 27 06:36:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.212.92
description:
[2025-01-27 06:36:53 +0100] info [webmaild] 168.232.212.92 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-01-27 06:37:06 dovecot_login authenticator failed for ([185.168.173.87]) [185.168.173.87]:50648: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.171.159
description:
Jan 27 06:37:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.171.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
description:
Jan 27 06:37:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-27 06:37:36 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:41533: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-27 06:36:55 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:38244: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Jan 27 06:37:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.181.159.10
description:
Jan 27 06:37:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.181.159.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.159.10
description:
2025-01-27 06:37:09 dovecot_login authenticator failed for (ait.edu.gh) [5.181.159.10]:53500: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.171.159
description:
2025-01-27 06:37:16 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:41886: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-37.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 27 06:37:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.127.250.250
description:
[2025-01-27 06:38:11 +0100] info [webmaild] 189.127.250.250 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
description:
Jan 27 06:38:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 27 06:38:24 ait sshd[2701662]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-01-27 06:38:31 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:39152: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Jan 27 06:38:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-01-27 06:38:39 dovecot_login authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:35803: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
description:
Jan 27 06:37:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-01-27 06:37:49 dovecot_plain authenticator failed for (vainal) [185.113.49.23]:44754: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 27 06:37:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
description:
2025-01-27 06:38:18 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:52406: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
description:
Jan 27 06:38:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 27 06:37:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
description:
2025-01-27 06:37:45 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:65126: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 27 06:38:24 ait sshd[2701662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 27 06:38:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.237.235
description:
[2025-01-27 06:38:31 +0100] info [webmaild] 170.0.237.235 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
description:
2025-01-27 06:37:51 dovecot_login authenticator failed for d96469c2.static.ziggozakelijk.nl (D96469C3.static.ziggozakelijk.nl) [217.100.105.194]:49911: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-27 06:37:57 dovecot_login authenticator failed for ([183.196.174.235]) [183.196.174.235]:39271: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.81.170.69
description:
Jan 27 06:37:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.81.170.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.81.170.69
description:
2025-01-27 06:37:59 dovecot_login authenticator failed for ([208.81.170.69]) [208.81.170.69]:48404: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
description:
Jan 27 06:38:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
description:
2025-01-27 06:38:19 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:30438: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.50.230
description:
[2025-01-27 06:38:20 +0100] info [webmaild] 45.5.50.230 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-01-27 06:38:29 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:45692: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
description:
2025-01-27 06:38:28 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:56771: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
description:
Jan 27 06:38:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 27 06:39:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
description:
Jan 27 06:39:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
description:
2025-01-27 06:39:09 dovecot_login authenticator failed for ([111.61.87.152]) [111.61.87.152]:50872: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 06:39:19 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:33134: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.239.186
description:
2025-01-27 06:39:22 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:33647: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-27 06:39:30 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:53436: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-27 06:39:07 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:32658: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 27 06:39:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.32.7
description:
[2025-01-27 06:39:05 +0100] info [webmaild] 191.5.32.7 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-27 06:39:05 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:48714: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Jan 27 06:39:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 06:39:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.239.186
description:
Jan 27 06:39:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.239.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-27 06:40:42 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:63637: 535 Incorrect authentication data (set_id=prueba)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.219.110.215
description:
Jan 27 06:40:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.219.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.76
description:
2025-01-27 06:40:43 dovecot_login authenticator failed for ([104.241.228.76]) [104.241.228.76]:56680: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.219.110.215
description:
2025-01-27 06:40:44 dovecot_plain authenticator failed for 124-219-110-215.vdslpro.static.apol.com.tw [124.219.110.215]:52576: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.10.20
description:
Jan 27 06:40:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.10.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
description:
2025-01-27 06:40:23 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:54705: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 27 06:40:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.76
description:
Jan 27 06:40:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 27 06:41:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.133.17.20
description:
2025-01-27 06:41:32 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:56134: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 27 06:40:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-27 06:40:49 dovecot_login authenticator failed for ([112.123.199.111]) [112.132.14.159]:49278: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
description:
Jan 27 06:41:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
description:
2025-01-27 06:41:02 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:59294: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 27 06:41:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-27 06:41:19 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:55168: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Jan 27 06:42:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-01-27 06:42:03 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:35445: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 27 06:42:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.217
description:
Jan 27 06:41:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Jan 27 06:41:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-01-27 06:41:56 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:56155: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 06:42:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Jan 27 06:42:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-01-27 06:42:20 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:38818: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 27 06:42:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-27 06:42:30 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:60272: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.217
description:
2025-01-27 06:41:54 dovecot_login authenticator failed for ([195.178.110.217]) [195.178.110.217]:59329: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.197.126.103
description:
2025-01-27 06:42:10 dovecot_plain authenticator failed for (unhomes) [2.197.126.103]:54126: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-01-27 06:42:13 dovecot_plain authenticator failed for ([211.196.31.2]) [211.196.31.2]:32821: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-27 06:42:15 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:19183: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
description:
Jan 27 06:42:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
description:
2025-01-27 06:42:04 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:58410: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.197.126.103
description:
Jan 27 06:42:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.197.126.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Jan 27 06:43:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-01-27 06:43:04 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:50394: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-43.65.0.27.59


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.43.206.85
description:
[2025-01-27 06:42:48 +0100] info [webmaild] 5.43.206.85 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 06:43:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 27 06:43:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-43.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 27 06:43:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
description:
Jan 27 06:42:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
description:
2025-01-27 06:42:56 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:50900: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-27 06:43:24 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:56292: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-27 06:43:42 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:39340: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.21.215
description:
[2025-01-27 06:42:46 +0100] info [webmaild] 177.223.21.215 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Jan 27 06:43:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Jan 27 06:44:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.156.122
description:
Jan 27 06:44:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.156.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Jan 27 06:44:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.156.122
description:
2025-01-27 06:44:31 dovecot_plain authenticator failed for ([120.236.156.122]) [120.236.156.122]:48351: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-01-27 06:43:47 dovecot_plain authenticator failed for ([90.189.180.243]) [90.189.180.243]:49179: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-01-27 06:43:57 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:44591: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.60.142
description:
2025-01-27 06:43:58 dovecot_plain authenticator failed for ([14.195.61.172]) [14.195.60.142]:55643: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.93
description:
Jan 27 06:44:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-01-27 06:44:19 dovecot_login authenticator failed for (5x167x48x130.dynamic.rostov.ertelecom.ru) [5.167.48.130]:60657: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.75.42
description:
Jan 27 06:44:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.75.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 06:44:08 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:42423: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
description:
2025-01-27 06:44:08 dovecot_plain authenticator failed for ([180.94.75.42]) [180.94.75.42]:45969: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-01-27 06:44:34 dovecot_login authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:53227: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-27 06:44:35 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:40672: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Jan 27 06:43:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.60.142
description:
Jan 27 06:43:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.60.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 06:44:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-27 06:44:16 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:57638: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 27 06:44:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-01-27 06:45:36 dovecot_plain authenticator failed for ([110.35.63.30]) [110.35.63.30]:35268: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 27 06:45:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.133
description:
Jan 27 06:45:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.133
description:
2025-01-27 06:45:13 dovecot_plain authenticator failed for (infusle) [65.20.193.133]:60248: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Jan 27 06:45:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 27 06:45:34 ait sshd[2704293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 27 06:45:34 ait sshd[2704293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.106.136.152
description:
Jan 27 06:46:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.106.136.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-01-27 06:46:05 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:59953: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
description:
Jan 27 06:46:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
description:
2025-01-27 06:46:17 dovecot_plain authenticator failed for ([183.6.43.236]) [183.6.43.236]:36255: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
description:
2025-01-27 06:46:20 dovecot_login authenticator failed for ([47.206.63.169]) [47.206.63.169]:46862: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 06:46:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.106.154.237
description:
Jan 27 06:46:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.106.154.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.106.154.237
description:
2025-01-27 06:46:31 dovecot_login authenticator failed for ([149.106.154.237]) [149.106.154.237]:52470: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-27 06:45:45 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:24479: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Jan 27 06:46:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
description:
Jan 27 06:46:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Jan 27 06:46:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Jan 27 06:47:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Jan 27 06:47:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-01-27 06:47:39 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:54876: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
description:
Jan 27 06:46:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-27 06:47:03 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:43384: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Jan 27 06:47:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 27 06:47:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-27 06:47:11 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:60793: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-01-27 06:47:15 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com [98.10.121.246]:51714: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-01-27 06:47:28 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:35561: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-01-27 06:47:31 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:39772: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-01-27 06:46:57 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:44627: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
description:
2025-01-27 06:46:57 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:45572: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Jan 27 06:47:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
description:
2025-01-27 06:46:51 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:58438: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Jan 27 06:47:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.54.56.69
description:
[2025-01-27 06:46:57 +0100] info [webmaild] 5.54.56.69 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 27 06:47:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-27 06:47:37 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:34949: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Jan 27 06:47:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-01-27 06:47:36 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:40963: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.106.136.152
description:
2025-01-27 06:46:46 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:57208: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
description:
Jan 27 06:46:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-01-27 06:47:06 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:39576: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.214
description:
Jan 27 06:47:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 27 06:48:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Jan 27 06:48:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.0.78.32
description:
2025-01-27 06:48:28 dovecot_plain authenticator failed for fl-71-0-78-32.dhcp.embarqhsd.net [71.0.78.32]:41472: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
description:
Jan 27 06:48:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 27 06:47:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
description:
Jan 27 06:47:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
description:
2025-01-27 06:47:53 dovecot_login authenticator failed for ([60.172.230.184]) [60.172.230.184]:51541: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
description:
2025-01-27 06:47:54 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:56644: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
description:
Jan 27 06:48:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
description:
2025-01-27 06:48:41 dovecot_plain authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:33707: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-27 06:48:28 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:44380: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-27 06:47:50 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:56420: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
description:
Jan 27 06:47:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.65.227.12
description:
2025-01-27 06:48:18 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:44811: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.0.78.32
description:
Jan 27 06:48:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.0.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-01-27 06:48:05 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:41268: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.65.227.12
description:
Jan 27 06:48:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.65.227.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-01-27 06:48:29 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:40255: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
description:
Jan 27 06:48:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Jan 27 06:48:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
description:
2025-01-27 06:48:43 dovecot_plain authenticator failed for ([203.193.137.250]) [203.193.137.250]:54934: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 27 06:49:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.37.181
description:
Jan 27 06:49:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.37.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
description:
Jan 27 06:49:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 06:49:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 27 06:49:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Jan 27 06:49:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
description:
2025-01-27 06:49:01 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:60089: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-27 06:49:16 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:36109: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.175
description:
Jan 27 06:49:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-01-27 06:49:37 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:59118: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
description:
2025-01-27 06:48:45 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:44161: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-27 06:48:47 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:40702: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 27 06:48:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
description:
2025-01-27 06:49:32 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:59016: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-48.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-01-27 06:49:23 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:37450: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.236.61
description:
[2025-01-27 06:49:39 +0100] info [webmaild] 138.118.236.61 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-27 06:48:55 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:37456: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-01-27 06:49:28 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:35788: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 27 06:48:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
description:
Jan 27 06:48:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Jan 27 06:49:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.60.142
description:
2025-01-27 06:49:36 dovecot_plain authenticator failed for ([14.195.61.172]) [14.195.60.142]:64607: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Jan 27 06:49:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.60.142
description:
Jan 27 06:49:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.60.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 27 06:49:40 ait sshd[2706061]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 27 06:49:40 ait sshd[2706061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 27 06:49:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-27 06:49:55 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:36744: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 27 06:50:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-27 06:50:39 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:31701: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 27 06:50:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-27 06:50:42 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:43668: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-27 06:49:45 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:55152: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.37.181
description:
2025-01-27 06:49:45 dovecot_plain authenticator failed for ([158.140.37.181]) [158.140.37.181]:49785: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
description:
2025-01-27 06:49:46 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:48304: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.123.47
description:
2025-01-27 06:50:29 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [27.72.123.47]:54244: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.123.47
description:
Jan 27 06:50:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.123.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-01-27 06:50:40 dovecot_login authenticator failed for (m121-202-152-7.smartone.com) [121.202.152.7]:19654: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 27 06:49:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-27 06:49:55 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:47751: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 27 06:50:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-27 06:50:08 dovecot_plain authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:62473: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.171.159
description:
Jan 27 06:50:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.171.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.171.159
description:
2025-01-27 06:50:25 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:50920: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Jan 27 06:50:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 27 06:50:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-01-27 06:51:36 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:48521: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-01-27 06:51:40 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:34338: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-27 06:51:05 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:52260: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Jan 27 06:50:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-01-27 06:50:55 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:22417: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
description:
Jan 27 06:51:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.241.15
description:
Jan 27 06:51:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.241.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
description:
2025-01-27 06:51:18 dovecot_plain authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:57762: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Jan 27 06:51:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Jan 27 06:51:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-27 06:50:43 dovecot_plain authenticator failed for (host-80-241-253-238.customer.magticom.ge) [2.57.219.2]:41564: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.168.111.80
description:
Jan 27 06:51:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.168.111.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-27 06:52:14 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:47566: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-27 06:52:15 dovecot_plain authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:59802: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
description:
Jan 27 06:52:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.138.162
description:
2025-01-27 06:51:53 dovecot_plain authenticator failed for (201-91-242-196.customer.tdatabrasil.net.br) [201.63.138.162]:35477: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 27 06:52:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.162
description:
Jan 27 06:51:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 27 06:52:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.135.18.138
description:
Jan 27 06:52:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.135.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 27 06:52:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-27 06:52:02 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:21536: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.139.142
description:
2025-01-27 06:52:16 dovecot_plain authenticator failed for ([211.43.139.142]) [211.43.139.142]:47616: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 27 06:52:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
description:
2025-01-27 06:52:22 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:54544: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.227.4
description:
2025-01-27 06:52:27 dovecot_plain authenticator failed for wsip-70-183-227-4.pn.at.cox.net [70.183.227.4]:36264: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-01-27 06:52:38 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:52913: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
description:
2025-01-27 06:51:49 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:34619: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.168.111.80
description:
2025-01-27 06:52:00 dovecot_plain authenticator failed for 80.111.168.125.sta.wbroadband.net.au [125.168.111.80]:36436: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.139.142
description:
Jan 27 06:52:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.139.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.135.18.138
description:
2025-01-27 06:52:17 dovecot_login authenticator failed for ([61.135.18.138]) [61.135.18.138]:57951: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 27 06:52:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
description:
Jan 27 06:51:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.223.168.193
description:
Jan 27 06:52:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.223.168.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.183.227.4
description:
Jan 27 06:52:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.183.227.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Jan 27 06:52:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-27 06:52:28 dovecot_login authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:36800: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-27 06:52:26 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:45895: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Jan 27 06:53:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 27 06:53:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
description:
2025-01-27 06:53:28 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:6604: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.129.180
description:
2025-01-27 06:53:35 dovecot_plain authenticator failed for ([178.70.129.180]) [178.70.129.180]:41620: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-27 06:53:35 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:42875: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.144.42.158
description:
2025-01-27 06:53:03 dovecot_plain authenticator failed for (TINY-308480B7) [136.144.42.158]:26550: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-27 06:53:30 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.132.14.159]:60908: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.34.189.181
description:
Jan 27 06:53:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.34.189.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-01-27 06:53:16 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:58160: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.36.192.207
description:
2025-01-27 06:53:38 dovecot_plain authenticator failed for host-176-36-192-207.b024.la.net.ua [176.36.192.207]:52990: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 06:52:47 ait sshd[2707298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.229.201
description:
Jan 27 06:52:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.229.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-01-27 06:53:23 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:59378: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 27 06:53:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.36.192.207
description:
Jan 27 06:53:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.36.192.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.7.203.177
description:
Jan 27 06:53:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.7.203.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.143.72
description:
Jan 27 06:53:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.143.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.72
description:
2025-01-27 06:53:33 dovecot_login authenticator failed for ([197.255.143.72]) [197.255.143.72]:34461: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.144.42.158
description:
Jan 27 06:53:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.144.42.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.34.189.181
description:
2025-01-27 06:53:17 dovecot_plain authenticator failed for net-2-34-189-181.cust.vodafonedsl.it [2.34.189.181]:46162: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-27 06:52:44 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:45284: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 06:52:47 ait sshd[2707298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.229.201
description:
2025-01-27 06:52:56 dovecot_login authenticator failed for s201-229-68-64.ssvec.az.wi-power.com [64.68.229.201]:49240: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Jan 27 06:53:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
description:
2025-01-27 06:53:51 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:44436: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.65.160.119
description:
Jan 27 06:54:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.65.160.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
description:
2025-01-27 06:54:00 dovecot_plain authenticator failed for ([82.102.165.200]) [82.102.165.200]:52628: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.65.160.119
description:
2025-01-27 06:54:03 dovecot_plain authenticator failed for ([113.65.160.119]) [113.65.160.119]:47755: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.39.166
description:
2025-01-27 06:54:13 dovecot_plain authenticator failed for ([60.28.39.166]) [60.28.39.166]:36970: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
description:
Jan 27 06:53:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.178
description:
2025-01-27 06:54:10 dovecot_plain authenticator failed for 83-233-71-178.cust.bredband2.com [83.233.71.178]:36738: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 06:54:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.57.70.22
description:
2025-01-27 06:54:34 dovecot_login authenticator failed for (host-216-57-70-22-cal.net) [216.57.70.22]:49324: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.74.36
description:
2025-01-27 06:54:42 dovecot_login authenticator failed for ([164.92.74.36]) [164.92.74.36]:47848: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-27 06:54:21 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:58326: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.157
description:
Jan 27 06:54:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.157
description:
2025-01-27 06:54:30 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:56870: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Jan 27 06:53:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Jan 27 06:53:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 27 06:54:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-27 06:54:23 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:51122: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.57.70.22
description:
Jan 27 06:54:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.57.70.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.74.36
description:
Jan 27 06:54:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-01-27 06:53:47 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:23234: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.239.109.147
description:
2025-01-27 06:53:47 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:25408: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.39.166
description:
Jan 27 06:54:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.39.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.182.163
description:
[2025-01-27 06:54:20 +0100] info [webmaild] 170.79.182.163 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-01-27 06:53:47 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:54814: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.178
description:
Jan 27 06:54:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.239.109.147
description:
Jan 27 06:53:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.239.109.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.165.200
description:
Jan 27 06:53:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.165.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 27 06:54:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-54.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.28.76
description:
Jan 27 06:54:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.28.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.28.76
description:
2025-01-27 06:55:00 dovecot_plain authenticator failed for ([120.238.28.76]) [120.238.28.76]:57454: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 27 06:55:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-27 06:55:11 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:57502: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 27 06:55:36 ait sshd[2708574]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 27 06:55:36 ait sshd[2708574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.52.96
description:
Jan 27 06:54:49 ait sshd[2708105]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.52.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.52.96
description:
Jan 27 06:54:49 ait sshd[2708105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.52.96


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 27 06:56:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.63.136.218
description:
Jan 27 06:56:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.63.136.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 27 06:56:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-27 06:56:22 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:50148: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Jan 27 06:56:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 27 06:56:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.244.68.3
description:
2025-01-27 06:56:24 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:10493: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.63.136.218
description:
2025-01-27 06:56:38 dovecot_plain authenticator failed for ([183.63.136.218]) [183.63.136.218]:49757: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 27 06:56:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-27 06:56:19 dovecot_login authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:46056: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 06:56:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
description:
Jan 27 06:56:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
description:
2025-01-27 06:56:43 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:45287: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.134.13.108
description:
Jan 27 06:56:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.134.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 27 06:56:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-27 06:56:35 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:60454: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.134.13.108
description:
2025-01-27 06:56:06 dovecot_login authenticator failed for ([117.134.13.108]) [117.134.13.108]:33532: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-01-27 06:56:26 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:36645: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.52.96
description:
Jan 27 06:57:18 ait sshd[2709121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.52.96


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-27 06:56:44 dovecot_plain authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:50965: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.52.96
description:
Jan 27 06:57:18 ait sshd[2709121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.52.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
description:
2025-01-27 06:57:01 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:50940: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
description:
Jan 27 06:56:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-01-27 06:58:38 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:55848: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.231.87
description:
2025-01-27 06:58:43 dovecot_login authenticator failed for ([59.103.231.87]) [59.103.231.87]:57208: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.52.96
description:
Jan 27 06:58:30 ait sshd[2709505]: Failed password for invalid user dev from 103.146.52.96 port 42998 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.52.96
description:
Jan 27 06:58:28 ait sshd[2709505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.52.96


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.52.96
description:
Jan 27 06:58:28 ait sshd[2709505]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.52.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Jan 27 06:58:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.103.231.87
description:
Jan 27 06:58:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.103.231.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.253.195
description:
[2025-01-27 06:58:27 +0100] info [webmaild] 45.190.253.195 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.213.193.49
description:
2025-01-27 06:58:56 dovecot_login authenticator failed for ([103.213.193.49]) [103.213.193.49]:2552: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.250.241
description:
Jan 27 06:59:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.250.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.250.241
description:
2025-01-27 06:59:25 dovecot_login authenticator failed for ([31.141.250.241]) [31.141.250.241]:60122: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 06:59:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Jan 27 06:58:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.193.49
description:
Jan 27 06:58:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.193.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-01-27 06:58:55 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:48963: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 27 06:59:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-27 07:00:00 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:47262: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 27 07:00:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-27 07:00:09 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:35027: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.41.161.202
description:
Jan 27 07:00:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.41.161.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.41.161.202
description:
2025-01-27 07:00:21 dovecot_plain authenticator failed for host202.sub-63-41-161.myvzw.com [63.41.161.202]:54609: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.96.73.181
description:
[2025-01-27 07:00:29 +0100] info [webmaild] 186.96.73.181 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Jan 27 07:00:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-01-27 07:00:32 dovecot_plain authenticator failed for ([90.189.180.243]) [90.189.180.243]:56370: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.49.14
description:
Jan 27 06:59:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.49.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
description:
2025-01-27 06:59:46 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:41840: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.166.23.162
description:
[2025-01-27 07:00:08 +0100] info [webmaild] 190.166.23.162 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Jan 27 07:00:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-01-27 07:01:28 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:39066: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 27 07:01:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Jan 27 07:01:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.191.170.208
description:
2025-01-27 07:01:01 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:40410: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 27 07:01:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-01-27 07:01:21 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:58180: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
description:
2025-01-27 07:01:25 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:33486: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
description:
Jan 27 07:01:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.104.218
description:
2025-01-27 07:01:17 dovecot_plain authenticator failed for ([91.75.104.218]) [91.75.104.218]:52363: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
description:
Jan 27 07:01:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
description:
2025-01-27 07:00:56 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:59412: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.191.170.208
description:
Jan 27 07:00:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.191.170.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 27 07:01:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-27 07:01:07 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:37507: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-01-27 07:01:12 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:53127: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.75.104.218
description:
Jan 27 07:01:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.75.104.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-27 07:01:34 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:49948: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Jan 27 07:01:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.58.118
description:
Jan 27 07:01:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.58.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.58.118
description:
2025-01-27 07:01:24 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:33596: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-01.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.152.210
description:
[2025-01-27 07:01:41 +0100] info [webmaild] 45.231.152.210 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 27 07:00:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.76.79.244
description:
[2025-01-27 07:01:14 +0100] info [webmaild] 189.76.79.244 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-01-27 07:00:44 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:43874: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
description:
Jan 27 07:01:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 27 07:01:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
description:
2025-01-27 07:01:08 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:60390: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-27 07:01:09 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:56292: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-01-27 07:01:16 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:59062: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
description:
Jan 27 07:01:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
description:
2025-01-27 07:01:21 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:35178: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Jan 27 07:01:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
description:
2025-01-27 07:01:29 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:32936: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 07:02:12 ait sshd[2711091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 27 07:02:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.161.107.85
description:
[2025-01-27 07:01:47 +0100] info [webmaild] 187.161.107.85 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 07:02:12 ait sshd[2711091]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-27 07:02:33 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:34954: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Jan 27 07:02:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.80.201
description:
2025-01-27 07:02:07 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:40569: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 27 07:02:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.123.47
description:
[2025-01-27 07:02:07 +0100] info [webmaild] 177.39.123.47 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-27 07:01:47 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:34436: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 27 07:02:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-27 07:02:20 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:30521: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Jan 27 07:02:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-01-27 07:02:28 dovecot_plain authenticator failed for (excersory) [64.72.74.162]:43579: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 27 07:01:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-27 07:03:20 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:18313: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-01-27 07:02:45 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:36982: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 07:02:57 ait sshd[2711497]: Invalid user musikschule-deuerling.de 2a01 from 111.231.56.128 port 53784


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 07:02:58 ait sshd[2711497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 07:02:58 ait sshd[2711497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.142.94.237
description:
Jan 27 07:02:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.142.94.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Jan 27 07:03:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-01-27 07:03:11 dovecot_plain authenticator failed for (189-56-217-183.customer.tdatabrasil.net.br) [189.56.217.183]:51733: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Jan 27 07:03:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-01-27 07:03:25 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:33002: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 07:03:36 ait sshd[2711831]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 07:03:36 ait sshd[2711831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-01-27 07:03:15 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:29777: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Jan 27 07:03:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Jan 27 07:03:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-01-27 07:03:25 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:52684: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 27 07:03:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-27 07:03:30 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:47236: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.96.22.50
description:
[2025-01-27 07:03:35 +0100] info [webmaild] 186.96.22.50 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.142.94.237
description:
2025-01-27 07:03:00 dovecot_plain authenticator failed for ([85.142.94.237]) [85.142.94.237]:43462: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 27 07:03:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.158.138.179
description:
Jan 27 07:03:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.158.138.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
description:
2025-01-27 07:03:41 dovecot_plain authenticator failed for ([103.158.138.179]) [103.158.138.179]:54152: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.172
description:
2025-01-27 07:04:02 dovecot_plain authenticator failed for ([112.28.128.172]) [112.28.128.172]:39006: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Jan 27 07:04:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-01-27 07:04:11 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:40132: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.31.231.157
description:
[2025-01-27 07:04:19 +0100] info [webmaild] 5.31.231.157 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.223
description:
Jan 27 07:04:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
description:
2025-01-27 07:04:40 dovecot_plain authenticator failed for (plewanfal) [65.20.155.223]:40557: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.7.243
description:
[2025-01-27 07:03:53 +0100] info [webmaild] 143.202.7.243 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.128.172
description:
Jan 27 07:04:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.128.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 27 07:04:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-27 07:04:42 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:60567: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-27 07:05:43 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:33895: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 27 07:04:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-27 07:04:53 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:37192: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 27 07:05:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.45.167.29
description:
Jan 27 07:05:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.45.167.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Jan 27 07:05:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.150.87.70
description:
Jan 27 07:06:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.150.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
description:
2025-01-27 07:06:12 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:59051: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
description:
Jan 27 07:06:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
description:
2025-01-27 07:06:44 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:49308: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 07:05:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.155.146
description:
Jan 27 07:06:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.150.87.70
description:
2025-01-27 07:06:10 dovecot_plain authenticator failed for ([193.150.87.70]) [193.150.87.70]:51742: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Jan 27 07:06:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.40
description:
Jan 27 07:06:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-01-27 07:06:08 dovecot_plain authenticator failed for (mydrant) [65.20.194.40]:42333: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:06:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
description:
2025-01-27 07:06:35 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:40004: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-01-27 07:06:01 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:42144: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-01-27 07:06:01 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:35457: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-01-27 07:06:38 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:40087: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.45.167.29
description:
2025-01-27 07:05:53 dovecot_plain authenticator failed for net-2-45-167-29.cust.vodafonedsl.it [2.45.167.29]:48254: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Jan 27 07:07:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
description:
Jan 27 07:07:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
description:
2025-01-27 07:06:56 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:55973: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 07:07:04 ait sshd[2713008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 27 07:07:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-27 07:07:25 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:50074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
description:
Jan 27 07:06:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 07:07:04 ait sshd[2713008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-27 07:07:29 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:60830: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-01-27 07:07:16 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:40103: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
description:
Jan 27 07:08:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
description:
Jan 27 07:08:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
description:
2025-01-27 07:08:04 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:50994: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
description:
2025-01-27 07:08:27 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:51850: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
description:
Jan 27 07:08:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-01-27 07:08:42 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:52714: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Jan 27 07:07:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-27 07:08:17 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:45935: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 27 07:08:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Jan 27 07:08:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-01-27 07:08:35 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:34867: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Jan 27 07:08:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
description:
2025-01-27 07:08:39 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:57202: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-01-27 07:07:51 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:60071: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 07:09:21 ait sshd[2714001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-01-27 07:08:54 dovecot_plain authenticator failed for ([82.208.99.163]) [82.208.99.163]:59792: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-01-27 07:09:00 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:57250: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Jan 27 07:09:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-27 07:09:06 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (whonous) [83.254.126.238]:37582: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
description:
2025-01-27 07:09:11 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:56312: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 07:09:21 ait sshd[2714001]: Invalid user ewert-werbung.com 2a00 from 122.51.104.242 port 38958


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.199.75
description:
2025-01-27 07:09:33 dovecot_plain authenticator failed for (twing) [65.20.199.75]:37398: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.218.91.40
description:
[2025-01-27 07:08:53 +0100] info [webmaild] 91.218.91.40 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
description:
Jan 27 07:08:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-01-27 07:09:12 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:53816: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.199.75
description:
Jan 27 07:09:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.199.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.113.52
description:
[2025-01-27 07:08:45 +0100] info [webmaild] 45.170.113.52 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 27 07:09:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Jan 27 07:09:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-01-27 07:09:14 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:35726: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Jan 27 07:08:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-27 07:09:05 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:58222: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
description:
Jan 27 07:09:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-01-27 07:09:01 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:60647: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 27 07:09:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
description:
2025-01-27 07:08:52 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:40146: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-01-27 07:09:03 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:33117: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-01-27 07:09:05 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:46927: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Jan 27 07:09:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 27 07:09:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-01-27 07:09:09 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:33142: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.248.3
description:
2025-01-27 07:09:22 dovecot_plain authenticator failed for ([176.113.248.3]) [176.113.248.3]:37170: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-27 07:10:14 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:48971: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-27 07:10:23 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:48450: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 27 07:09:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-27 07:09:57 dovecot_login authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:57230: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 27 07:10:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.2.165
description:
2025-01-27 07:10:23 dovecot_plain authenticator failed for (rucceproco) [41.33.2.165]:47822: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.169.19.43
description:
Jan 27 07:10:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.169.19.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.169.19.43
description:
2025-01-27 07:10:32 dovecot_plain authenticator failed for wsip-70-169-19-43.hr.hr.cox.net [70.169.19.43]:48912: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-27 07:10:00 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:58447: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.254.71
description:
2025-01-27 07:10:02 dovecot_plain authenticator failed for (bedneserle) [89.175.254.71]:57130: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-27 07:10:42 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:39404: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.33.2.165
description:
Jan 27 07:10:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.33.2.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 27 07:10:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 27 07:11:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Jan 27 07:10:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-01-27 07:10:53 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:33876: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-01-27 07:11:31 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:48574: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 07:12:07 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:53714: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 27 07:12:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-01-27 07:12:19 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:54802: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Jan 27 07:12:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-12.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-01-27 07:12:27 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:34095: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.61.61.19
description:
2025-01-27 07:12:37 dovecot_plain authenticator failed for ([45.61.61.19]) [45.61.61.19]:49148: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 07:11:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.54.36
description:
Jan 27 07:11:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.54.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
description:
2025-01-27 07:11:59 dovecot_plain authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:52360: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.209.193.147
description:
2025-01-27 07:12:16 dovecot_plain authenticator failed for ([186.209.193.147]) [186.209.193.147]:45256: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-27 07:11:46 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:53693: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 07:11:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 07:11:55 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:58094: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.122.18.148
description:
Jan 27 07:12:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.122.18.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-01-27 07:12:34 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:49666: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
description:
Jan 27 07:12:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
description:
2025-01-27 07:12:27 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:60582: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
description:
2025-01-27 07:11:59 dovecot_plain authenticator failed for ([60.172.54.36]) [60.172.54.36]:51162: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.193.147
description:
Jan 27 07:12:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.193.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-27 07:12:16 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:36301: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Jan 27 07:12:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.122.18.148
description:
2025-01-27 07:12:23 dovecot_plain authenticator failed for ([202.122.18.148]) [202.122.18.148]:33754: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 27 07:13:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-01-27 07:12:57 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:35914: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.119.68
description:
Jan 27 07:13:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.119.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.184.80.124
description:
[2025-01-27 07:13:01 +0100] info [webmaild] 197.184.80.124 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-27 07:13:37 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:20243: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-27 07:13:22 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:38612: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.119.68
description:
2025-01-27 07:13:25 dovecot_plain authenticator failed for p72069-obmd01.osaka.ocn.ne.jp [180.7.119.68]:37569: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.137.26
description:
2025-01-27 07:13:33 dovecot_plain authenticator failed for ([112.28.137.26]) [112.28.137.26]:48390: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Jan 27 07:12:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.172.215.89
description:
[2025-01-27 07:13:18 +0100] info [webmaild] 187.172.215.89 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.137.26
description:
Jan 27 07:13:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-01-27 07:14:25 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:39972: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
description:
2025-01-27 07:13:46 dovecot_plain authenticator failed for ([220.180.107.193]) [220.180.107.193]:34960: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 27 07:13:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-27 07:13:59 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:1875: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Jan 27 07:14:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-01-27 07:14:03 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:41763: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-01-27 07:14:17 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:55921: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
description:
Jan 27 07:14:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 27 07:13:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-27 07:13:56 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:44752: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Jan 27 07:14:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-01-27 07:14:35 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:55695: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
description:
Jan 27 07:14:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
description:
2025-01-27 07:15:06 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:49754: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Jan 27 07:15:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-27 07:15:04 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:56111: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-01-27 07:15:11 dovecot_plain authenticator failed for ([125.142.39.13]) [125.142.39.13]:35733: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-01-27 07:15:16 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:58568: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 27 07:15:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Jan 27 07:15:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:14:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
description:
2025-01-27 07:14:58 dovecot_plain authenticator failed for ([183.134.209.86]) [183.134.209.86]:38308: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.225.68.108
description:
2025-01-27 07:15:02 dovecot_plain authenticator failed for 90-225-68-108-no2666.tbcn.telia.com [90.225.68.108]:44772: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.225.68.108
description:
Jan 27 07:15:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.225.68.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.92.86.18
description:
Jan 27 07:15:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.92.86.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.86.18
description:
2025-01-27 07:15:14 dovecot_plain authenticator failed for (static-14.38.103.extranet.co.in) [111.92.86.18]:50852: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-27 07:15:15 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:43043: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
description:
2025-01-27 07:14:55 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:48220: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 07:14:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 07:14:58 dovecot_plain authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:57090: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-27 07:16:16 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:40684: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-01-27 07:16:39 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:57171: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-27 07:15:46 dovecot_plain authenticator failed for (piers) [164.92.243.206]:43876: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 07:15:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Jan 27 07:16:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 27 07:16:06 ait sshd[2716548]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 07:16:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 27 07:15:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.91.176.243
description:
Jan 27 07:16:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.91.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 27 07:16:06 ait sshd[2716548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
description:
2025-01-27 07:16:36 dovecot_plain authenticator failed for ([118.91.176.243]) [118.91.176.243]:32770: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-27 07:16:37 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:36042: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-01-27 07:16:06 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:33926: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 27 07:16:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-27 07:17:43 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:52678: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.253.87
description:
2025-01-27 07:16:46 dovecot_plain authenticator failed for (chents) [185.254.253.87]:34788: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.253.87
description:
Jan 27 07:16:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.253.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-27 07:16:48 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:52401: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-01-27 07:16:57 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:43760: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
description:
Jan 27 07:16:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-27 07:17:16 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:59964: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Jan 27 07:16:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-01-27 07:16:46 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:56302: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-01-27 07:16:48 dovecot_plain authenticator failed for (videoifolder.ru) [78.108.186.10]:33952: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
description:
Jan 27 07:16:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 27 07:17:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 27 07:17:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 27 07:16:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.219.34
description:
Jan 27 07:17:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.219.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-01-27 07:17:59 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:46388: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-01-27 07:18:07 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:39949: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.72.99
description:
Jan 27 07:18:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.72.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-27 07:17:46 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:42666: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.72.99
description:
2025-01-27 07:18:31 dovecot_plain authenticator failed for ([152.52.72.99]) [152.52.72.99]:49511: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Jan 27 07:17:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.219.34
description:
2025-01-27 07:17:58 dovecot_plain authenticator failed for ([186.233.219.34]) [186.233.219.34]:46690: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-18.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 27 07:17:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
description:
2025-01-27 07:17:58 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:58064: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
description:
Jan 27 07:18:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-01-27 07:18:42 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:40660: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.212.105.34
description:
Jan 27 07:18:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.212.105.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.212.105.34
description:
2025-01-27 07:18:53 dovecot_plain authenticator failed for ([102.212.105.34]) [102.212.105.34]:37452: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Jan 27 07:19:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-01-27 07:19:18 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:40671: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-27 07:19:30 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:31876: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 27 07:19:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 07:18:49 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (cantrilly) [51.255.84.180]:40092: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-01-27 07:19:06 dovecot_plain authenticator failed for (factomop) [65.20.162.187]:37955: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 27 07:20:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-27 07:20:38 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:32910: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Jan 27 07:19:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 27 07:20:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-27 07:20:29 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:56330: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 27 07:20:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-01-27 07:19:57 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:55042: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 27 07:20:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-01-27 07:20:41 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:37380: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-27 07:20:10 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:45432: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 07:20:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 07:20:27 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:53464: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 27 07:20:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.13
description:
2025-01-27 07:20:32 dovecot_login authenticator failed for 013.143.48.116.static.netvigator.com [116.48.143.13]:61013: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-27 07:20:19 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:51906: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-27 07:20:51 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:37887: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-27 07:20:57 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:47041: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 27 07:21:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 27 07:21:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Jan 27 07:20:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-27 07:21:43 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:58792: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 07:21:33 ait sshd[2719295]: Invalid user ewert-werbung.com 2a00 from 122.51.104.242 port 45144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 27 07:20:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.63.225.184
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-20.178.63.225.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-01-27 07:20:58 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:43500: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 27 07:21:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.184.86.186
description:
Jan 27 07:21:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.184.86.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.29.53
description:
2025-01-27 07:21:18 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:44082: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-27 07:20:59 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:10829: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-27 07:21:02 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:36085: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.227.206.247
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-21.165.227.206.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-27 07:21:06 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:15451: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 27 07:20:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
description:
2025-01-27 07:21:10 dovecot_plain authenticator failed for (fratedic) [65.20.204.164]:47058: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 07:21:15 ait sshd[2719189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
description:
Jan 27 07:21:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 07:21:33 ait sshd[2719295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-27 07:20:44 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:56777: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.164
description:
Jan 27 07:21:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.184.86.186
description:
2025-01-27 07:21:09 dovecot_plain authenticator failed for ([222.184.86.186]) [222.184.86.186]:36852: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 07:21:15 ait sshd[2719189]: Invalid user musikschule-deuerling.de 2a01 from 111.231.56.128 port 50088


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 07:21:15 ait sshd[2719189]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-27 07:21:43 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:56795: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Jan 27 07:22:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 07:21:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.45.10
description:
2025-01-27 07:21:58 dovecot_plain authenticator failed for ([125.32.45.10]) [125.32.45.10]:60748: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 07:22:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 07:22:06 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:44098: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-27 07:22:34 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:49502: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Jan 27 07:21:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.45.10
description:
Jan 27 07:21:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 07:22:19 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:35479: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 27 07:22:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 27 07:21:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-27 07:21:59 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:45498: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 27 07:22:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-01-27 07:22:42 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:43250: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 07:21:54 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:49126: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-01-27 07:21:57 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:43900: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Jan 27 07:23:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Jan 27 07:23:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-01-27 07:23:21 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:58586: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-27 07:23:31 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:59540: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
description:
Jan 27 07:23:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 27 07:22:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-27 07:22:49 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:58094: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-27 07:22:56 dovecot_plain authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:65051: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-01-27 07:23:09 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:52458: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.147.2.19
description:
[2025-01-27 07:23:11 +0100] info [webmaild] 41.147.2.19 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 27 07:23:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-27 07:24:16 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:37610: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.97
description:
Jan 27 07:24:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-01-27 07:24:31 dovecot_plain authenticator failed for (parle) [65.20.160.195]:43314: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.66
description:
2025-01-27 07:24:32 dovecot_login authenticator failed for ([193.32.162.66]) [193.32.162.66]:57852: 535 Incorrect authentication data (set_id=backup)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-24.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 07:24:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-01-27 07:24:23 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:53830: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 27 07:24:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-27 07:24:27 dovecot_plain authenticator failed for (poecres) [65.20.143.159]:37710: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Jan 27 07:24:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.73
description:
Jan 27 07:24:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.81
description:
Jan 27 07:24:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Jan 27 07:24:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-27 07:24:11 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:48774: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 27 07:24:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.97
description:
2025-01-27 07:24:28 dovecot_login authenticator failed for ([193.32.162.97]) [193.32.162.97]:56085: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-27 07:24:29 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:58028: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.73
description:
2025-01-27 07:24:45 dovecot_login authenticator failed for ([193.32.162.73]) [193.32.162.73]:49455: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.83
description:
2025-01-27 07:24:52 dovecot_login authenticator failed for ([193.32.162.83]) [193.32.162.83]:51573: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 27 07:24:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-01-27 07:24:09 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:34089: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 27 07:24:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Jan 27 07:24:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.66
description:
Jan 27 07:24:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.83
description:
Jan 27 07:24:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.81
description:
2025-01-27 07:25:00 dovecot_login authenticator failed for ([193.32.162.81]) [193.32.162.81]:63572: 535 Incorrect authentication data (set_id=fax)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 27 07:25:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-27 07:25:10 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (tomors) [62.63.230.241]:34146: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.180.113.155
description:
Jan 27 07:25:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.180.113.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.180.113.155
description:
2025-01-27 07:25:17 dovecot_plain authenticator failed for syn-072-180-113-155.res.spectrum.com [72.180.113.155]:56716: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 27 07:25:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-27 07:25:26 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:34383: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.138
description:
2025-01-27 07:26:27 dovecot_plain authenticator failed for ([112.91.124.138]) [112.91.124.138]:46883: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.156
description:
Jan 27 07:26:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-01-27 07:26:46 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:55160: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Jan 27 07:26:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.138
description:
Jan 27 07:26:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Jan 27 07:26:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.156
description:
2025-01-27 07:26:33 dovecot_login authenticator failed for (nsg-corporate-156.229.187.122.airtel.in) [122.187.229.156]:39695: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 27 07:26:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 07:26:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-01-27 07:26:16 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:39425: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 07:26:38 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (macresde) [51.255.84.180]:50550: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-27 07:26:38 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:41853: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-27 07:26:28 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:35472: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Jan 27 07:26:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.168.134.188
description:
[2025-01-27 07:27:08 +0100] info [webmaild] 105.168.134.188 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.225.53.149
description:
2025-01-27 07:27:22 dovecot_plain authenticator failed for ([173.225.53.149]) [173.225.53.149]:60508: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 27 07:27:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.225.53.149
description:
Jan 27 07:27:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.225.53.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Jan 27 07:27:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-01-27 07:27:30 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:35486: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 07:27:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 27 07:27:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-27 07:27:46 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:45179: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-27 07:27:05 dovecot_login authenticator failed for (170.250.152.88.hwccustomers.com) [170.250.152.88]:52490: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-27 07:27:18 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:34924: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.176.186.20
description:
[2025-01-27 07:27:47 +0100] info [webmaild] 196.176.186.20 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:27:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 27 07:27:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Jan 27 07:28:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 27 07:28:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.30.20.5
description:
[2025-01-27 07:28:38 +0100] info [webmaild] 5.30.20.5 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 07:28:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 27 07:28:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
description:
2025-01-27 07:28:23 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:60891: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-01-27 07:28:26 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:37338: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-27 07:28:27 dovecot_plain authenticator failed for (unbermams) [109.108.95.66]:56732: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
description:
2025-01-27 07:28:38 dovecot_plain authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:59906: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 27 07:28:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 07:28:49 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:50946: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.178.21.162
description:
2025-01-27 07:28:09 dovecot_login authenticator failed for ([123.178.21.162]) [123.178.21.162]:42860: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 27 07:28:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 27 07:28:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.166.78
description:
Jan 27 07:28:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.166.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-27 07:28:49 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (coudaha) [109.67.154.24]:63084: 535 Incorrect authentication data (set_id=eng20a00105y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.178.21.162
description:
Jan 27 07:28:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.178.21.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.211.155
description:
2025-01-27 07:28:07 dovecot_plain authenticator failed for p383156-obmd01.tokyo.ocn.ne.jp [60.38.211.155]:42701: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 07:28:21 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:48070: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-27 07:28:31 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:60252: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-27 07:29:01 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:49733: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-27 07:29:03 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:58421: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 27 07:29:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 27 07:29:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 07:29:43 ait sshd[2723907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Jan 27 07:28:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 27 07:29:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-27 07:29:03 dovecot_plain authenticator failed for 9498.telnet.bg (micattes) [87.254.165.100]:48810: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 07:29:43 ait sshd[2723907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.45.175.126
description:
[2025-01-27 07:29:04 +0100] info [webmaild] 177.45.175.126 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-27 07:29:16 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:44192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-01-27 07:30:14 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:25691: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-27 07:30:19 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:36866: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-27 07:30:24 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:50308: 535 Incorrect authentication data (set_id=sales@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-01-27 07:30:37 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (agulvers) [2.36.64.247]:47760: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-27 07:30:59 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:55367: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-30.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 27 07:30:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Jan 27 07:30:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Jan 27 07:30:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-27 07:30:37 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:13754: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 27 07:30:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
description:
Jan 27 07:30:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 27 07:30:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-27 07:30:08 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:32146: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.120.93
description:
[2025-01-27 07:30:21 +0100] info [webmaild] 157.100.120.93 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-01-27 07:30:00 dovecot_login authenticator failed for ([50.224.22.135]) [50.224.22.135]:42115: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-27 07:30:05 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:20030: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 27 07:30:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
description:
2025-01-27 07:30:24 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:32180: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 27 07:30:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.83.165
description:
[2025-01-27 07:30:55 +0100] info [webmaild] 170.150.83.165 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 27 07:30:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Jan 27 07:29:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 27 07:30:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 27 07:31:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-27 07:31:00 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:18852: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 27 07:31:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-27 07:31:11 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:37597: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Jan 27 07:31:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-01-27 07:31:23 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:35970: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.120.97
description:
Jan 27 07:31:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.120.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.35.196
description:
Jan 27 07:31:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.35.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.107.78.242
description:
[2025-01-27 07:31:04 +0100] info [webmaild] 103.107.78.242 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 07:31:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 07:31:10 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:49289: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.120.97
description:
2025-01-27 07:31:35 dovecot_plain authenticator failed for v2202501250131308547.bestsrv.de [152.53.120.97]:48350: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 70.45.202.114
description:
[2025-01-27 07:32:25 +0100] info [webmaild] 70.45.202.114 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.175.242
description:
Jan 27 07:32:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.175.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.242
description:
2025-01-27 07:32:34 dovecot_plain authenticator failed for (ancost) [65.20.175.242]:46386: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 27 07:31:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.73.174
description:
[2025-01-27 07:32:22 +0100] info [webmaild] 169.224.73.174 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.211.36.7
description:
[2025-01-27 07:32:23 +0100] info [webmaild] 179.211.36.7 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 27 07:32:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-27 07:33:53 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:60709: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 27 07:33:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-01-27 07:33:38 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:35146: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 27 07:33:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-27 07:33:00 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:55356: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 27 07:33:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-27 07:33:24 dovecot_plain authenticator failed for (bienes) [154.144.243.93]:48214: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-27 07:33:35 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:38550: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Jan 27 07:33:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.175.242
description:
Jan 27 07:33:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.175.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.242
description:
2025-01-27 07:33:51 dovecot_plain authenticator failed for (diums) [65.20.175.242]:49224: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 27 07:34:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-27 07:34:36 dovecot_login authenticator failed for ([222.160.227.134]) [222.160.227.134]:42856: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 27 07:34:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-27 07:34:49 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:34540: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-27 07:35:51 dovecot_plain authenticator failed for ([116.114.84.242]) [116.114.84.242]:53542: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 07:35:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 27 07:35:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-27 07:35:47 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:59401: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.252.96
description:
Jan 27 07:35:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.252.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 27 07:35:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-27 07:35:55 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:43454: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.225.202
description:
Jan 27 07:35:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.95.225.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.95.225.202
description:
2025-01-27 07:35:25 dovecot_plain authenticator failed for ([23.95.225.202]) [23.95.225.202]:42120: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 27 07:35:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 27 07:35:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 27 07:35:45 ait sshd[2727456]: Invalid user universitypublishing from 175.126.195.176 port 50193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 27 07:35:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.52.107
description:
Jan 27 07:35:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.52.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
description:
2025-01-27 07:35:18 dovecot_plain authenticator failed for ([112.196.52.107]) [112.196.52.107]:34630: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 07:35:24 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:40758: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:35:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.252.96
description:
2025-01-27 07:35:51 dovecot_plain authenticator failed for p96096-obmd01.tokyo.ocn.ne.jp [124.101.252.96]:46803: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-27 07:35:53 dovecot_login authenticator failed for (57.252.223.60.adsl-pool.sx.cn) [60.223.252.57]:37490: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
description:
Jan 27 07:35:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 07:35:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 07:35:35 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (retia) [51.255.84.180]:48460: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-27 07:35:37 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:53097: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 07:35:45 ait sshd[2727456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 27 07:36:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.87.152.13
description:
[2025-01-27 07:36:39 +0100] info [webmaild] 213.87.152.13 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-01-27 07:36:04 dovecot_plain authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:47822: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Jan 27 07:36:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-27 07:36:08 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:45892: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-27 07:36:36 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:53509: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-27 07:36:43 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:42650: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
description:
2025-01-27 07:36:00 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:35602: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 27 07:36:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.111.157.85
description:
[2025-01-27 07:36:05 +0100] info [webmaild] 187.111.157.85 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-01-27 07:36:11 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:42378: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.31.174.3
description:
Jan 27 07:36:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.31.174.3 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-36.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 07:36:49 ait sshd[2728032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.199.165
description:
Jan 27 07:36:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 27 07:36:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 07:36:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 07:36:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.165.114
description:
2025-01-27 07:36:05 dovecot_plain authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:50984: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 27 07:36:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.165.114
description:
Jan 27 07:36:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 27 07:36:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 27 07:36:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.40.142.57
description:
2025-01-27 07:36:41 dovecot_plain authenticator failed for (overm) [102.40.142.57]:59606: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-27 07:36:45 dovecot_plain authenticator failed for (stord) [102.53.15.54]:42298: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-27 07:36:10 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:60680: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-27 07:36:14 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:35634: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 27 07:36:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
description:
Jan 27 07:36:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 27 07:36:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 07:36:48 ait sshd[2728032]: Invalid user envergure224.com 2a00 from 111.231.56.128 port 53852


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-27 07:36:23 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:36837: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-27 07:36:25 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:41512: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-27 07:37:56 dovecot_plain authenticator failed for ([8.20.22.58]) [8.20.22.58]:58875: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-27 07:37:56 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:33822: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.89.64.47
description:
Jan 27 07:37:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.89.64.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 27 07:37:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.89.64.47
description:
2025-01-27 07:37:51 dovecot_plain authenticator failed for fe938964-c47.eso-es.net [93.89.64.47]:60996: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 27 07:37:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 27 07:37:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
description:
2025-01-27 07:37:20 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:59975: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.219.34
description:
Jan 27 07:37:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.219.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.219.34
description:
2025-01-27 07:37:58 dovecot_plain authenticator failed for ([186.233.219.34]) [186.233.219.34]:43478: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
description:
2025-01-27 07:37:08 dovecot_plain authenticator failed for ([121.202.200.120]) [121.202.200.120]:6786: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Jan 27 07:37:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-27 07:37:35 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:57636: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
description:
Jan 27 07:37:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
description:
2025-01-27 07:38:21 dovecot_plain authenticator failed for ([60.214.127.246]) [60.214.127.246]:27603: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 27 07:38:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.223
description:
2025-01-27 07:38:34 dovecot_login authenticator failed for ([93.182.160.223]) [93.182.160.223]:41416: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 27 07:38:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-27 07:38:08 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:53612: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-01-27 07:38:13 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:50693: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
description:
Jan 27 07:38:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-27 07:38:40 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:30766: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.202.224
description:
Jan 27 07:38:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.202.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
description:
Jan 27 07:38:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.224
description:
2025-01-27 07:38:10 dovecot_plain authenticator failed for ([196.46.202.224]) [196.46.202.224]:41231: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
description:
2025-01-27 07:38:18 dovecot_login authenticator failed for ([111.61.177.3]) [111.61.177.3]:55140: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-27 07:38:27 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:60856: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.223
description:
Jan 27 07:38:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 27 07:38:43 ait sshd[2728998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 27 07:38:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 27 07:38:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-27 07:38:24 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:41936: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 27 07:38:43 ait sshd[2728998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
description:
Jan 27 07:38:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 27 07:39:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-27 07:39:13 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:49716: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-27 07:39:17 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:49910: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 07:39:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 27 07:39:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 27 07:39:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-27 07:39:05 dovecot_login authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:63072: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.225.136.75
description:
[2025-01-27 07:39:06 +0100] info [webmaild] 200.225.136.75 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 27 07:39:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-27 07:39:25 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:46416: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-27 07:39:25 dovecot_plain authenticator failed for (mantrang) [102.53.15.54]:46979: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-27 07:40:38 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:59610: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-27 07:40:55 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:57686: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.225.169
description:
Jan 27 07:40:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.225.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 07:40:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:40:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.253.15
description:
[2025-01-27 07:40:44 +0100] info [webmaild] 143.255.253.15 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 07:40:18 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:59088: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.30.141.222
description:
Jan 27 07:40:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.30.141.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-01-27 07:40:35 dovecot_login authenticator failed for (5x167x48x130.dynamic.rostov.ertelecom.ru) [5.167.48.130]:60123: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-27 07:40:02 dovecot_plain authenticator failed for (emizably) [109.160.123.6]:38598: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 07:40:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.30.141.222
description:
2025-01-27 07:40:29 dovecot_login authenticator failed for ([58.30.141.222]) [58.30.141.222]:57784: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 27 07:40:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.225.169
description:
2025-01-27 07:40:17 dovecot_login authenticator failed for net-2-37-225-169.cust.vodafonedsl.it [2.37.225.169]:57111: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Jan 27 07:40:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 27 07:40:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 27 07:40:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 07:40:07 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:49464: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 07:40:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 07:40:15 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:53624: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.235
description:
2025-01-27 07:41:49 dovecot_plain authenticator failed for (arthewing) [65.20.168.235]:50952: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 27 07:41:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.40.142.57
description:
2025-01-27 07:41:54 dovecot_plain authenticator failed for (resilikey) [102.40.142.57]:56876: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-27 07:41:25 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:61380: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 27 07:41:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.60
description:
47.128.52.60 - - [27/Jan/2025:07:41:51 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=32053339 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?filter_course-language=121&filtering=1&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-01-27 07:41:52 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net (coutinigri) [77.157.174.51]:46085: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.27.132
description:
Jan 27 07:41:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.27.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 27 07:41:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.103.231.87
description:
Jan 27 07:41:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.103.231.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.231.87
description:
2025-01-27 07:41:42 dovecot_login authenticator failed for ([59.103.231.87]) [59.103.231.87]:62481: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.235
description:
Jan 27 07:41:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-27 07:41:51 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:40511: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.27.132
description:
2025-01-27 07:41:57 dovecot_plain authenticator failed for c188-150-27-132.bredband.tele2.se (renlea) [188.150.27.132]:59670: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:41:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.53
description:
Jan 27 07:41:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.53
description:
2025-01-27 07:41:16 dovecot_plain authenticator failed for ([102.69.163.53]) [102.69.163.53]:44643: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 07:42:02 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:60586: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-27 07:42:14 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:52693: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 27 07:42:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-27 07:42:40 dovecot_plain authenticator failed for (mintious) [62.231.31.86]:36023: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
description:
2025-01-27 07:42:27 dovecot_plain authenticator failed for (tarabled) [185.232.37.90]:39890: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Jan 27 07:42:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-27 07:42:37 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:41312: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 27 07:42:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 27 07:42:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-42.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-27 07:42:41 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:52690: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 07:42:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 27 07:42:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-27 07:42:15 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:44596: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.37.90
description:
Jan 27 07:42:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.37.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-27 07:42:28 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:47728: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 27 07:42:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.221.56
description:
Jan 27 07:43:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.221.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.234
description:
2025-01-27 07:43:36 dovecot_plain authenticator failed for (aulus) [65.20.169.234]:37323: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Jan 27 07:43:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-27 07:43:51 dovecot_plain authenticator failed for (homaze) [77.239.255.163]:33928: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.88.104
description:
2025-01-27 07:43:35 dovecot_login authenticator failed for ([1.235.88.104]) [1.235.88.104]:39289: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 27 07:43:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-27 07:43:22 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:40878: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.234
description:
Jan 27 07:43:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.88.234
description:
2025-01-27 07:43:35 dovecot_plain authenticator failed for ([188.59.88.234]) [188.59.88.234]:45250: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.221.56
description:
2025-01-27 07:43:37 dovecot_plain authenticator failed for ([183.236.221.56]) [183.236.221.56]:36648: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.88.104
description:
Jan 27 07:43:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.88.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.88.234
description:
Jan 27 07:43:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.88.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-01-27 07:43:43 dovecot_plain authenticator failed for ([80.233.77.136]) [80.233.77.136]:61861: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Jan 27 07:43:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-01-27 07:43:46 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:38998: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 27 07:43:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-27 07:44:02 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:47206: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 07:44:12 ait sshd[2731952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.235.100.6
description:
2025-01-27 07:44:13 dovecot_plain authenticator failed for host-105-235-100-6.afnet.net [105.235.100.6]:50979: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 07:44:12 ait sshd[2731952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 27 07:44:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-27 07:44:22 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:37900: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-01-27 07:44:28 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:58966: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 07:44:54 ait sshd[2732308]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 27 07:44:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 07:44:54 ait sshd[2732308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.53.152.38
description:
2025-01-27 07:44:03 dovecot_plain authenticator failed for ([71.53.152.38]) [71.53.152.38]:40277: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.235.100.6
description:
Jan 27 07:44:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.235.100.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Jan 27 07:44:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.138.130.17
description:
Jan 27 07:44:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.138.130.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.138.130.17
description:
2025-01-27 07:44:41 dovecot_plain authenticator failed for p578a8211.dip0.t-ipconnect.de (degiopting) [87.138.130.17]:47551: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
description:
Jan 27 07:45:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-27 07:45:30 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:35556: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
description:
2025-01-27 07:45:42 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:52799: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.250.238.189
description:
2025-01-27 07:45:03 dovecot_plain authenticator failed for c83-250-238-189.bredband.tele2.se (nopoter) [83.250.238.189]:34132: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-27 07:45:18 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:51726: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.126
description:
Jan 27 07:45:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.250.238.189
description:
Jan 27 07:45:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.250.238.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 27 07:45:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.195.146
description:
Jan 27 07:45:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.4.195.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.4.195.146
description:
2025-01-27 07:45:49 dovecot_plain authenticator failed for (ip146.ip-142-4-195.net) [142.4.195.146]:36628: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
description:
2025-01-27 07:45:57 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:54193: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 27 07:45:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 27 07:45:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-27 07:45:54 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:47206: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 27 07:46:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-27 07:46:07 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:57228: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 27 07:46:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-01-27 07:46:47 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:56166: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


