# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 31 08:24:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-31 08:24:10 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:34155: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-01-31 08:24:11 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:38748: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.248
description:
Jan 31 08:24:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-31 08:24:29 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:34384: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
description:
Jan 31 08:23:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.248.27.76
description:
2025-01-31 08:24:00 dovecot_plain authenticator failed for ([45.248.27.76]) [45.248.27.76]:54141: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Jan 31 08:24:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-01-31 08:24:02 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:42382: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-01-31 08:24:20 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:59477: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-31 08:24:12 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:40953: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
description:
Jan 31 08:24:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.80.147.162
description:
[2025-01-31 08:23:40 +0100] info [webmaild] 201.80.147.162 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.248.27.76
description:
Jan 31 08:23:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.248.27.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Jan 31 08:24:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-31 08:24:26 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:54527: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-01-31 08:23:48 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:43314: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Jan 31 08:24:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 31 08:24:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 31 08:24:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
description:
2025-01-31 08:24:24 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:19714: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Jan 31 08:24:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
description:
Jan 31 08:24:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.117.197.238
description:
2025-01-31 08:24:43 dovecot_plain authenticator failed for net-109-117-197-238.cust.vodafonedsl.it [109.117.197.238]:59187: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-24.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 31 08:25:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-31 08:25:03 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:60670: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-31 08:25:12 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:58898: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.138.121.18
description:
Jan 31 08:25:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.138.121.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-31 08:25:26 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:64022: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
description:
2025-01-31 08:24:31 dovecot_plain authenticator failed for 111-70-23-248.emome-ip.hinet.net [111.70.23.248]:50104: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-01-31 08:24:38 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:40662: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-01-31 08:24:39 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:35524: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.117.197.238
description:
Jan 31 08:24:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.117.197.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 31 08:25:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.247.63.22
description:
[2025-01-31 08:25:24 +0100] info [webmaild] 91.247.63.22 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 31 08:25:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.231.46
description:
[2025-01-31 08:24:50 +0100] info [webmaild] 109.107.231.46 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.138.121.18
description:
2025-01-31 08:25:25 dovecot_login authenticator failed for (undefined.hostname.localhost) [120.138.121.18]:55460: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-01-31 08:26:01 dovecot_login authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:53230: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.112.55
description:
2025-01-31 08:26:15 dovecot_plain authenticator failed for ([112.186.112.55]) [112.186.112.55]:48075: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Jan 31 08:26:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Jan 31 08:25:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.249.76
description:
2025-01-31 08:26:28 dovecot_login authenticator failed for p93076-obmd01.tokyo.ocn.ne.jp [124.101.249.76]:58780: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-01-31 08:26:27 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:19178: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.32.96.252
description:
Jan 31 08:25:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.32.96.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Jan 31 08:25:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.112.55
description:
Jan 31 08:26:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.112.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
description:
2025-01-31 08:25:43 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:52376: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Jan 31 08:25:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-01-31 08:25:59 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:44973: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.227.33
description:
[2025-01-31 08:26:21 +0100] info [webmaild] 109.107.227.33 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.249.76
description:
Jan 31 08:26:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.249.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-01-31 08:25:42 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:47070: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-31 08:26:43 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:40039: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 08:26:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 118.103.255.69
description:
[2025-01-31 08:27:05 +0100] info [webmaild] 118.103.255.69 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
description:
2025-01-31 08:27:05 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:35676: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.19.170.166
description:
Jan 31 08:27:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.19.170.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
description:
Jan 31 08:27:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 31 08:26:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
description:
2025-01-31 08:26:39 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:48207: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.209
description:
Jan 31 08:27:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.19.170.166
description:
2025-01-31 08:27:11 dovecot_login authenticator failed for ([202.188.165.198]) [210.19.170.166]:63269: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.250.241
description:
2025-01-31 08:27:12 dovecot_login authenticator failed for ([31.141.250.241]) [31.141.250.241]:33478: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
description:
2025-01-31 08:26:58 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:57433: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 31 08:26:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
description:
Jan 31 08:27:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-01-31 08:26:55 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:10899: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
description:
Jan 31 08:26:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.250.241
description:
Jan 31 08:27:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.250.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 31 08:27:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Jan 31 08:26:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Jan 31 08:26:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
description:
2025-01-31 08:27:09 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:41856: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 31 08:26:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.131
description:
47.128.43.131 - - [31/Jan/2025:08:26:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21524812 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/complete-guide-to-instagram-growth/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-01-31 08:26:58 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:57107: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-31 08:27:20 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:43446: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-31 08:26:39 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:40017: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
description:
2025-01-31 08:27:01 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:37085: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
description:
2025-01-31 08:27:17 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:38018: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
description:
Jan 31 08:26:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-31 08:28:20 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:40046: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Jan 31 08:27:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
description:
2025-01-31 08:27:44 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:47847: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Jan 31 08:27:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Jan 31 08:28:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-31 08:28:16 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:47115: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
description:
Jan 31 08:27:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.96.79.238
description:
[2025-01-31 08:28:09 +0100] info [webmaild] 92.96.79.238 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-31 08:28:17 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:40652: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 31 08:28:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-01-31 08:27:55 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:43251: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-01-31 08:27:39 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:40212: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 31 08:27:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-31 08:27:45 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:46831: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 31 08:28:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
description:
Jan 31 08:27:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
description:
2025-01-31 08:27:34 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:55402: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-01-31 08:28:38 dovecot_plain authenticator failed for ([200.151.121.49]) [200.151.9.74]:37765: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-31 08:28:45 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:34123: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.123
description:
2025-01-31 08:28:53 dovecot_login authenticator failed for ([197.255.143.123]) [197.255.143.123]:36599: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Jan 31 08:29:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 31 08:28:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.170.246
description:
[2025-01-31 08:28:56 +0100] info [webmaild] 176.29.170.246 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-31 08:29:04 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:40232: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 08:29:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.143.123
description:
Jan 31 08:28:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.143.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
description:
Jan 31 08:28:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.200.99
description:
Jan 31 08:28:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.200.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.99
description:
2025-01-31 08:29:00 dovecot_login authenticator failed for (197-255-200-99.netpagedns.net) [197.255.200.99]:48695: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 31 08:29:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-31 08:29:04 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:37160: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 31 08:29:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.170.5.210
description:
Jan 31 08:29:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.170.5.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Jan 31 08:28:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.170.5.210
description:
2025-01-31 08:29:11 dovecot_plain authenticator failed for ([39.170.5.210]) [39.170.5.210]:43258: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-01-31 08:28:52 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:51562: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
description:
2025-01-31 08:28:57 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:51737: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-01-31 08:29:12 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:57158: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 31 08:28:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 31 08:30:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
description:
2025-01-31 08:30:05 dovecot_login authenticator failed for (m121-202-155-16.smartone.com) [121.202.155.16]:29988: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.234.208
description:
Jan 31 08:30:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.234.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.234.208
description:
2025-01-31 08:30:23 dovecot_plain authenticator failed for (deenetservices.net) [103.89.234.208]:37140: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 31 08:29:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-31 08:29:52 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:33136: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.130.124
description:
[2025-01-31 08:30:14 +0100] info [webmaild] 131.72.130.124 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 31 08:29:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-31 08:29:40 dovecot_login authenticator failed for ([171.244.40.236]) [171.244.40.236]:34386: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-31 08:29:39 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:29984: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-31 08:30:04 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:55754: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-30.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 31 08:29:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
description:
Jan 31 08:30:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.97.63.206
description:
Jan 31 08:31:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.97.63.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 08:31:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-31 08:31:05 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:47610: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 31 08:31:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.63.206
description:
2025-01-31 08:31:24 dovecot_plain authenticator failed for ([211.97.63.206]) [211.97.63.206]:43741: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 31 08:30:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.147.163.56
description:
[2025-01-31 08:30:59 +0100] info [webmaild] 103.147.163.56 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-31 08:30:34 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:39878: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.151.29
description:
[2025-01-31 08:31:46 +0100] info [webmaild] 41.56.151.29 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-01-31 08:32:21 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:40433: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
description:
2025-01-31 08:32:25 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:51870: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
description:
Jan 31 08:32:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
description:
Jan 31 08:32:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
description:
2025-01-31 08:32:15 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:46654: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Jan 31 08:32:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.82.207.91
description:
[2025-01-31 08:32:23 +0100] info [webmaild] 41.82.207.91 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 31 08:33:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-01-31 08:33:22 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:52558: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 31 08:33:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-01-31 08:32:49 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:51439: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
description:
Jan 31 08:32:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Jan 31 08:32:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 08:33:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Jan 31 08:33:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-31 08:33:31 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:32242: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Jan 31 08:32:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-01-31 08:32:33 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:43728: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
description:
2025-01-31 08:33:01 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:55346: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 31 08:33:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-01-31 08:33:58 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:42638: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 08:33:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
description:
Jan 31 08:33:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 31 08:33:58 ait sshd[1433541]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Jan 31 08:34:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.124.65.207
description:
[2025-01-31 08:34:28 +0100] info [webmaild] 200.124.65.207 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Jan 31 08:34:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-01-31 08:34:10 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:52642: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 31 08:33:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-31 08:33:41 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:49228: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
description:
2025-01-31 08:33:49 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:38054: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 31 08:33:58 ait sshd[1433541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 31 08:34:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 31 08:34:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Jan 31 08:34:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-01-31 08:34:18 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:55524: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.37.125
description:
[2025-01-31 08:33:44 +0100] info [webmaild] 191.242.37.125 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
description:
Jan 31 08:33:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-31 08:34:07 dovecot_login authenticator failed for ([14.97.143.225]) [182.71.173.250]:56640: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-01-31 08:34:19 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:37312: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 31 08:34:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Jan 31 08:34:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 31 08:35:27 ait sshd[1434524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-01-31 08:35:14 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:11359: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.223.200.4
description:
[2025-01-31 08:35:23 +0100] info [webmaild] 186.223.200.4 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Jan 31 08:35:27 ait sshd[1434524]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-01-31 08:35:13 dovecot_plain authenticator failed for ([221.13.138.138]) [221.13.138.138]:57410: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-35.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 31 08:35:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-31 08:34:50 dovecot_plain authenticator failed for ([189.56.79.105]) [186.200.249.162]:57325: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Jan 31 08:35:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Jan 31 08:35:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.15.251.33
description:
Jan 31 08:35:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.15.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.15.251.33
description:
2025-01-31 08:35:28 dovecot_plain authenticator failed for ([59.15.251.33]) [59.15.251.33]:38674: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 31 08:34:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 08:34:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 31 08:34:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-01-31 08:35:01 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:50908: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 08:36:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 31 08:36:20 ait sshd[1434830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.100.241.193
description:
[2025-01-31 08:36:08 +0100] info [webmaild] 131.100.241.193 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.110.128
description:
47.128.110.128 - - [31/Jan/2025:08:36:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27760748 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?filter_course-category=30&filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 31 08:36:20 ait sshd[1434830]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-36.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Jan 31 08:35:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 31 08:35:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
description:
2025-01-31 08:37:13 dovecot_plain authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:52247: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
description:
2025-01-31 08:37:23 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:47138: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Jan 31 08:37:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
description:
Jan 31 08:37:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Jan 31 08:37:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.66.209
description:
Jan 31 08:37:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.66.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
description:
Jan 31 08:37:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
description:
2025-01-31 08:37:05 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:46613: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-01-31 08:37:12 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:49606: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.39.84.144
description:
[2025-01-31 08:37:25 +0100] info [webmaild] 187.39.84.144 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-01-31 08:37:24 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:50672: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 31 08:37:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.184.114
description:
Jan 31 08:37:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.184.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-31 08:37:48 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:40022: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.184.114
description:
2025-01-31 08:37:49 dovecot_plain authenticator failed for ([163.142.184.114]) [163.142.184.114]:36754: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Jan 31 08:38:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.198.143
description:
[2025-01-31 08:38:08 +0100] info [webmaild] 168.232.198.143 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.124.180
description:
2025-01-31 08:38:21 dovecot_plain authenticator failed for 180.124.103.218.static.netvigator.com [218.103.124.180]:61307: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.207.50
description:
Jan 31 08:37:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.207.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-01-31 08:37:39 dovecot_login authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([127.0.0.1]) [61.216.7.163]:47079: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 31 08:37:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-01-31 08:38:04 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:56640: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.124.180
description:
Jan 31 08:38:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.124.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Jan 31 08:38:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Jan 31 08:37:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
description:
2025-01-31 08:37:41 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:47490: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.207.50
description:
2025-01-31 08:37:47 dovecot_login authenticator failed for vps-f5bece10.vps.ovh.net ([127.0.0.1]) [135.125.207.50]:34838: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-31 08:37:58 dovecot_plain authenticator failed for ([121.142.146.167]) [121.142.146.167]:57702: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
description:
Jan 31 08:37:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.161
description:
Jan 31 08:39:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.161
description:
2025-01-31 08:39:22 dovecot_plain authenticator failed for (nlos-200-161.zamnet.zm) [196.46.200.161]:59854: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Jan 31 08:38:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 31 08:38:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.210.84
description:
[2025-01-31 08:38:46 +0100] info [webmaild] 138.204.210.84 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 31 08:40:13 ait sshd[1436428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.208
description:
Jan 31 08:40:22 ait sshd[1436075]: error: maximum authentication attempts exceeded for root from 218.92.0.208 port 28188 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-31 08:39:37 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:41142: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.208
description:
Jan 31 08:40:01 ait sshd[1436075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.171.47.84
description:
[2025-01-31 08:39:33 +0100] info [webmaild] 93.171.47.84 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 31 08:39:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.208
description:
Jan 31 08:40:01 ait sshd[1436075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.208  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 31 08:40:13 ait sshd[1436428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-01-31 08:40:43 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:53102: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 31 08:40:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 31 08:40:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.254.225.100
description:
2025-01-31 08:41:20 dovecot_plain authenticator failed for 100.225.254.193.infosys.su [193.254.225.100]:46339: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-01-31 08:40:36 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:35556: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-31 08:41:26 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:34613: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-01-31 08:41:03 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:40650: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 31 08:41:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Jan 31 08:41:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.254.225.100
description:
Jan 31 08:41:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.254.225.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Jan 31 08:40:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.36.219.94
description:
[2025-01-31 08:40:59 +0100] info [webmaild] 200.36.219.94 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Jan 31 08:41:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-01-31 08:41:16 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:53272: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Jan 31 08:40:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-01-31 08:41:09 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:33655: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
description:
Jan 31 08:41:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
description:
Jan 31 08:40:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-01-31 08:40:53 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:64775: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.166.73
description:
Jan 31 08:41:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.166.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-31 08:40:57 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:40355: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
description:
2025-01-31 08:41:13 dovecot_plain authenticator failed for ([117.158.166.73]) [117.158.166.73]:46734: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Jan 31 08:41:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
description:
2025-01-31 08:41:24 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:47866: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-31 08:40:53 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:56390: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-01-31 08:41:35 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:43524: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.195.198
description:
Jan 31 08:42:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.224
description:
2025-01-31 08:42:20 dovecot_plain authenticator failed for 110-25-105-224.adsl.fetnet.net [110.25.105.224]:56715: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.30.141.222
description:
2025-01-31 08:42:21 dovecot_login authenticator failed for ([58.30.141.222]) [58.30.141.222]:59703: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 08:42:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.17.143.18
description:
[2025-01-31 08:42:18 +0100] info [webmaild] 187.17.143.18 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 31 08:41:34 ait sshd[1436968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Jan 31 08:41:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-01-31 08:41:40 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:36691: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
description:
2025-01-31 08:42:07 dovecot_login authenticator failed for ([47.206.63.169]) [47.206.63.169]:50720: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.224
description:
Jan 31 08:42:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.195.198
description:
2025-01-31 08:42:20 dovecot_plain authenticator failed for ([221.10.195.198]) [221.10.195.198]:42304: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Jan 31 08:41:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.175.149.86
description:
[2025-01-31 08:41:40 +0100] info [webmaild] 5.175.149.86 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 31 08:41:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-31 08:41:58 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:2339: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Jan 31 08:41:34 ait sshd[1436968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-41.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
description:
Jan 31 08:42:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.30.141.222
description:
Jan 31 08:42:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.30.141.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-01-31 08:42:45 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:51255: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.97.198
description:
Jan 31 08:42:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.97.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.15.251.33
description:
Jan 31 08:42:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.15.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
description:
2025-01-31 08:42:50 dovecot_plain authenticator failed for ([197.156.97.198]) [197.156.97.198]:55322: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 31 08:42:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
description:
Jan 31 08:43:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-01-31 08:42:45 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:41406: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.76.50.72
description:
[2025-01-31 08:43:04 +0100] info [webmaild] 80.76.50.72 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-31 08:43:12 dovecot_plain authenticator failed for ([121.142.146.167]) [121.142.146.167]:56059: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.208.174
description:
Jan 31 08:43:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.208.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 31 08:43:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
description:
2025-01-31 08:43:17 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:49319: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.42.129
description:
47.128.42.129 - - [31/Jan/2025:08:43:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24752978 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/help.php?module=quiz&file=shuffleanswers.html" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.42.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.15.251.33
description:
2025-01-31 08:42:35 dovecot_plain authenticator failed for ([59.15.251.33]) [59.15.251.33]:33736: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Jan 31 08:42:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-31 08:42:58 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:50577: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
description:
Jan 31 08:44:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
description:
2025-01-31 08:44:23 dovecot_plain authenticator failed for (ctw.webcas.net) [125.69.76.148]:58090: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Jan 31 08:43:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-01-31 08:43:33 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:60561: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.214.84
description:
2025-01-31 08:44:41 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.214.84]:52687: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-01-31 08:44:48 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:36692: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.227.237.17
description:
[2025-01-31 08:45:15 +0100] info [webmaild] 191.227.237.17 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Jan 31 08:45:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-01-31 08:45:27 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:52275: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
description:
Jan 31 08:44:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.218.12.252
description:
Jan 31 08:44:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.218.12.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.218.12.252
description:
2025-01-31 08:45:00 dovecot_plain authenticator failed for ([173.218.12.252]) [173.218.12.252]:49352: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-01-31 08:45:29 dovecot_plain authenticator failed for ([188.168.12.14]) [188.168.12.14]:51626: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.236.183
description:
Jan 31 08:44:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.236.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.236.183
description:
2025-01-31 08:44:34 dovecot_plain authenticator failed for ([27.45.236.183]) [27.45.236.183]:39222: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.85.157
description:
[2025-01-31 08:44:33 +0100] info [webmaild] 191.5.85.157 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.214.84
description:
Jan 31 08:44:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.214.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Jan 31 08:44:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
description:
2025-01-31 08:44:49 dovecot_login authenticator failed for ([127.0.0.1]) [94.207.226.113]:35135: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Jan 31 08:45:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 31 08:45:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 31 08:45:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Jan 31 08:46:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-01-31 08:46:17 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:25549: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 31 08:45:37 ait sshd[1438497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
description:
Jan 31 08:45:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.100.75
description:
[2025-01-31 08:45:42 +0100] info [webmaild] 177.104.100.75 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.99.198.230
description:
[2025-01-31 08:46:28 +0100] info [webmaild] 138.99.198.230 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-31 08:45:59 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:45909: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-01-31 08:46:15 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:38815: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-01-31 08:45:40 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:55490: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-01-31 08:46:04 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:39308: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Jan 31 08:46:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.35.18
description:
Jan 31 08:46:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.35.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
description:
2025-01-31 08:46:24 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:40944: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Jan 31 08:45:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-01-31 08:45:44 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:43096: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.249.82
description:
Jan 31 08:46:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.249.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Jan 31 08:46:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-31 08:46:34 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:52917: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
description:
Jan 31 08:46:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
description:
2025-01-31 08:46:49 dovecot_plain authenticator failed for ([183.249.1.72]) [183.249.1.72]:44039: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 31 08:46:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 31 08:47:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
description:
2025-01-31 08:47:17 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:55988: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-31 08:46:52 dovecot_plain authenticator failed for (sigma) [185.65.238.250]:54498: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
description:
2025-01-31 08:47:04 dovecot_plain authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:52880: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.133.17.20
description:
2025-01-31 08:47:09 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:29852: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 31 08:46:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
description:
Jan 31 08:47:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
description:
Jan 31 08:47:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.155.176.161
description:
[2025-01-31 08:48:05 +0100] info [webmaild] 195.155.176.161 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-48.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
description:
2025-01-31 08:49:13 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:47490: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-31 08:49:14 dovecot_login authenticator failed for ([14.37.125.43]) [14.37.125.43]:47666: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-01-31 08:49:22 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:45522: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Jan 31 08:48:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-01-31 08:48:53 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:32974: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 08:49:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
description:
Jan 31 08:49:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 31 08:49:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Jan 31 08:49:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.50.226.241
description:
[2025-01-31 08:48:48 +0100] info [webmaild] 200.50.226.241 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.175.118.48
description:
[2025-01-31 08:49:12 +0100] info [webmaild] 185.175.118.48 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Jan 31 08:49:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-01-31 08:49:29 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:39768: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.243.251
description:
2025-01-31 08:49:34 dovecot_plain authenticator failed for ([111.75.243.251]) [111.75.243.251]:41834: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
description:
2025-01-31 08:50:08 dovecot_plain authenticator failed for ([114.53.252.246]) [124.136.29.20]:44249: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-31 08:50:26 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:40068: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
description:
Jan 31 08:50:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Jan 31 08:49:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.243.251
description:
Jan 31 08:49:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.243.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-01-31 08:49:33 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:36182: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.167.25
description:
Jan 31 08:49:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.167.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.167.25
description:
2025-01-31 08:49:44 dovecot_plain authenticator failed for ([187.95.167.25]) [187.95.167.25]:54579: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.156.114.121
description:
[2025-01-31 08:49:58 +0100] info [webmaild] 45.156.114.121 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 31 08:50:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
description:
2025-01-31 08:50:29 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:53246: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
description:
2025-01-31 08:51:01 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:34698: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Jan 31 08:51:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-01-31 08:51:21 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:53990: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
description:
Jan 31 08:51:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.180.35
description:
Jan 31 08:50:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.180.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.59.34.5
description:
Jan 31 08:51:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.59.34.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
description:
2025-01-31 08:51:29 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:59525: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.180.35
description:
2025-01-31 08:50:44 dovecot_plain authenticator failed for ([120.197.180.35]) [120.197.180.35]:56571: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Jan 31 08:51:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 08:51:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.124.145.199
description:
Jan 31 08:51:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.124.145.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.124.145.199
description:
2025-01-31 08:51:29 dovecot_plain authenticator failed for (64.124.145.199.IDIA-283681-ZYO.zip.zayo.com) [64.124.145.199]:36737: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
description:
2025-01-31 08:51:18 dovecot_plain authenticator failed for ([178.76.69.221]) [178.76.69.221]:57870: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
description:
Jan 31 08:50:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
description:
2025-01-31 08:51:10 dovecot_plain authenticator failed for ([113.59.34.8]) [113.59.34.5]:33040: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-31 08:50:48 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:51840: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.84.60
description:
Jan 31 08:51:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.84.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
description:
Jan 31 08:51:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
description:
2025-01-31 08:51:54 dovecot_plain authenticator failed for ([27.123.255.45]) [27.123.255.45]:43094: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.141.174.200
description:
[2025-01-31 08:52:16 +0100] info [webmaild] 103.141.174.200 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
description:
2025-01-31 08:51:42 dovecot_plain authenticator failed for ([31.41.84.60]) [31.41.84.60]:38858: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-31 08:52:20 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:52877: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
description:
Jan 31 08:52:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-01-31 08:52:28 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:6956: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 31 08:52:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 31 08:51:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-31 08:51:43 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:26511: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.141.152
description:
Jan 31 08:52:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.141.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.141.152
description:
2025-01-31 08:52:04 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:57812: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.196.36.98
description:
[2025-01-31 08:51:33 +0100] info [webmaild] 200.196.36.98 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 08:52:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 49.0.4.11
description:
[2025-01-31 08:53:25 +0100] info [webmaild] 49.0.4.11 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Jan 31 08:52:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.26.22
description:
[2025-01-31 08:52:37 +0100] info [webmaild] 37.239.26.22 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-01-31 08:52:40 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:58208: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
description:
2025-01-31 08:52:45 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:57841: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 31 08:52:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 31 08:52:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
description:
Jan 31 08:52:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-31 08:52:50 dovecot_plain authenticator failed for (comisonus) [88.87.84.104]:57981: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-31 08:52:58 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:60489: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Jan 31 08:53:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.182
description:
Jan 31 08:53:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-01-31 08:53:55 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4203: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.231.20
description:
2025-01-31 08:54:16 dovecot_plain authenticator failed for ([103.156.231.20]) [103.156.231.20]:39743: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Jan 31 08:53:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.233.71.179
description:
2025-01-31 08:53:41 dovecot_login authenticator failed for ([127.0.0.1]) [222.233.71.179]:45484: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-01-31 08:53:44 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:44868: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
description:
2025-01-31 08:53:48 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:60749: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.82.20.241
description:
Jan 31 08:53:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.82.20.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
description:
2025-01-31 08:53:41 dovecot_plain authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:51186: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.114.85.95
description:
Jan 31 08:53:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.114.85.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.191.82
description:
2025-01-31 08:53:56 dovecot_plain authenticator failed for ([113.108.191.82]) [113.108.191.82]:41938: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.231.20
description:
Jan 31 08:54:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.231.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 31 08:53:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.233.71.179
description:
Jan 31 08:53:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.233.71.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-31 08:53:33 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:2689: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Jan 31 08:53:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.114.85.95
description:
2025-01-31 08:53:54 dovecot_plain authenticator failed for ([211.114.85.95]) [211.114.85.95]:57662: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.191.82
description:
Jan 31 08:53:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.191.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 08:53:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-01-31 08:53:31 dovecot_login authenticator failed for ([127.0.0.1]) [77.235.25.35]:55413: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-31 08:54:38 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:37696: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
description:
Jan 31 08:54:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-31 08:54:53 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:46898: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
description:
Jan 31 08:55:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.115.119
description:
Jan 31 08:54:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.115.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.115.119
description:
2025-01-31 08:54:34 dovecot_plain authenticator failed for (conata.static.gvt.net.br) [177.43.115.119]:55014: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 31 08:54:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-01-31 08:55:15 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:33132: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
description:
Jan 31 08:55:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
description:
2025-01-31 08:55:29 dovecot_plain authenticator failed for ([183.6.43.236]) [183.6.43.236]:37417: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.105
description:
2025-01-31 08:54:43 dovecot_login authenticator failed for (ADMIN) [212.112.19.105]:38440: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.223.181.167
description:
[2025-01-31 08:55:21 +0100] info [webmaild] 186.223.181.167 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.140.222.78
description:
[2025-01-31 08:56:25 +0100] info [webmaild] 41.140.222.78 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 31 08:56:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.191.71.148
description:
Jan 31 08:56:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.191.71.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.191.71.148
description:
2025-01-31 08:56:15 dovecot_login authenticator failed for ([127.0.0.1]) [113.191.71.148]:48203: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.6.198.208
description:
Jan 31 08:56:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.6.198.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.180.100.38
description:
Jan 31 08:56:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.180.100.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.180.100.38
description:
2025-01-31 08:56:25 dovecot_plain authenticator failed for 45-180-100-38.dynamic.tecnettelecom.net [45.180.100.38]:39400: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.6.212.150
description:
Jan 31 08:55:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.6.212.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-31 08:56:02 dovecot_plain authenticator failed for (undly) [94.140.210.134]:34417: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.73.118.3
description:
[2025-01-31 08:56:04 +0100] info [webmaild] 91.73.118.3 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 31 08:56:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-31 08:56:14 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:37270: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.6.198.208
description:
2025-01-31 08:56:24 dovecot_login authenticator failed for ([127.0.0.1]) [67.6.198.208]:58911: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.6.212.150
description:
2025-01-31 08:55:44 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.212.150]:12378: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 08:55:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.42.191
description:
47.128.42.191 - - [31/Jan/2025:08:56:41 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000619 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/0b1e03/search/results?ip=47.128.28.0&limit=10" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.42.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 31 08:56:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-31 08:56:56 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:33250: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.126.83.226
description:
[2025-01-31 08:57:12 +0100] info [webmaild] 189.126.83.226 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Jan 31 08:57:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.58
description:
2025-01-31 08:57:44 dovecot_plain authenticator failed for ([91.227.31.58]) [91.227.31.58]:35421: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Jan 31 08:57:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-01-31 08:57:55 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:32858: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 08:58:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-01-31 08:57:32 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:46144: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Jan 31 08:57:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-01-31 08:57:37 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:48230: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.58
description:
Jan 31 08:57:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Jan 31 09:00:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
description:
2025-01-31 09:00:30 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:54711: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.60.5
description:
47.128.60.5 - - [31/Jan/2025:08:59:37 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=3492442 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=79%2C118%2C120%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.60.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.76.202.22
description:
Jan 31 09:00:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.76.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.205.114.5
description:
[2025-01-31 09:00:02 +0100] info [webmaild] 37.205.114.5 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 62.233.39.238
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:abs2@ait.edu.gh||WPU:abs2@ait.edu.gh||RSV:6.65||T:APACHE||MV:09-00.62.233.39.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
description:
Jan 31 09:00:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.120.32.22
description:
[2025-01-31 08:59:44 +0100] info [webmaild] 190.120.32.22 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.69.200
description:
2025-01-31 08:59:44 dovecot_plain authenticator failed for ([178.232.69.200]) [178.232.69.200]:42634: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-01-31 08:59:47 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:52280: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
description:
Jan 31 09:00:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.69.200
description:
Jan 31 08:59:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.69.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.202.22
description:
2025-01-31 09:00:02 dovecot_login authenticator failed for ([218.76.202.22]) [218.76.202.22]:57946: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 31 09:00:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
description:
2025-01-31 09:00:20 dovecot_plain authenticator failed for ([211.53.58.10]) [211.53.58.10]:52209: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.40.105.187
description:
[2025-01-31 09:00:27 +0100] info [webmaild] 187.40.105.187 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.170
description:
2025-01-31 09:00:28 dovecot_plain authenticator failed for ([220.77.182.170]) [220.77.182.170]:34415: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-01-31 09:00:30 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:41818: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Jan 31 08:59:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-31 09:00:17 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:45339: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.170
description:
Jan 31 09:00:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.65.174
description:
2025-01-31 09:00:39 dovecot_plain authenticator failed for ([180.94.65.174]) [180.94.65.174]:47235: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-31 09:00:45 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:41938: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 31 09:01:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
description:
2025-01-31 09:01:09 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:54950: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 31 09:01:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
description:
Jan 31 09:01:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-31 09:01:22 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:47649: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.141.152
description:
2025-01-31 09:01:32 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:57818: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
description:
Jan 31 09:00:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
description:
2025-01-31 09:00:43 dovecot_plain authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:7338: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 31 09:00:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-31 09:01:06 dovecot_plain authenticator failed for ([188.226.47.211]) [188.226.47.211]:52012: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 31 09:01:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
description:
2025-01-31 09:01:20 dovecot_login authenticator failed for (undefined.hostname.localhost) [113.193.53.56]:38094: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
description:
2025-01-31 09:01:23 dovecot_plain authenticator failed for ([46.98.10.109]) [46.98.10.109]:54286: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.65.174
description:
Jan 31 09:00:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.65.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.85.154.174
description:
[2025-01-31 09:00:49 +0100] info [webmaild] 189.85.154.174 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 31 09:01:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.141.152
description:
Jan 31 09:01:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.141.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-01-31 09:01:55 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:35482: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Jan 31 09:02:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-01-31 09:02:30 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:44696: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Jan 31 09:01:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 31 09:01:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.105.61.23
description:
Jan 31 09:02:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.105.61.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.180.113.155
description:
2025-01-31 09:02:08 dovecot_plain authenticator failed for syn-072-180-113-155.res.spectrum.com [72.180.113.155]:35830: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.105.61.23
description:
2025-01-31 09:02:09 dovecot_plain authenticator failed for ([62.105.61.23]) [62.105.61.23]:53444: 535 Incorrect authentication data (set_id=assdas1)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-01.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-31 09:01:40 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:35982: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.180.113.155
description:
Jan 31 09:02:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.180.113.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Jan 31 09:03:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 31 09:03:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-31 09:03:16 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:53223: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-31 09:03:08 dovecot_plain authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:43640: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-31 09:03:09 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:43592: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.20
description:
Jan 31 09:02:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-31 09:02:59 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:43529: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 31 09:03:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 31 09:03:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.174.233
description:
[2025-01-31 09:03:29 +0100] info [webmaild] 177.66.174.233 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-31 09:03:29 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:24380: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.20
description:
2025-01-31 09:02:43 dovecot_plain authenticator failed for ([201.218.181.20]) [201.218.181.20]:58798: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-01-31 09:03:03 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:43530: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 31 09:03:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-31 09:03:16 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:54048: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.40.194
description:
2025-01-31 09:03:48 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:34020: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Jan 31 09:04:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-01-31 09:04:15 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:58900: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-31 09:04:23 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:3940: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 31 09:04:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 31 09:03:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.40.194
description:
Jan 31 09:03:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.248.40.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-31 09:03:46 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:47034: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Jan 31 09:04:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
description:
2025-01-31 09:04:25 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:49986: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-01-31 09:04:26 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:50574: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 31 09:04:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.152.14
description:
[2025-01-31 09:04:12 +0100] info [webmaild] 191.243.152.14 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.24.12.213
description:
[2025-01-31 09:04:13 +0100] info [webmaild] 201.24.12.213 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-31 09:04:08 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:56334: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 31 09:04:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
description:
Jan 31 09:04:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-31 09:04:26 dovecot_plain authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:34428: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 09:04:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.40.18.220
description:
Jan 31 09:03:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.40.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.88.104
description:
Jan 31 09:04:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.88.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.251.49.106
description:
Jan 31 09:04:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.251.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
description:
2025-01-31 09:05:16 dovecot_plain authenticator failed for ([5.130.173.74]) [5.130.173.74]:33624: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 31 09:05:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 31 09:05:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 31 09:04:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-04.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 31 09:05:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-31 09:05:02 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:55078: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-31 09:05:29 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:60764: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Jan 31 09:05:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
description:
Jan 31 09:05:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Jan 31 09:04:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.251.49.106
description:
2025-01-31 09:04:43 dovecot_plain authenticator failed for 116-251-49-106.pool.activ8me.net.au [116.251.49.106]:43130: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-01-31 09:04:45 dovecot_login authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:34361: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-01-31 09:05:07 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:38420: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.80.201
description:
2025-01-31 09:05:32 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:38945: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.23.88.237
description:
[2025-01-31 09:04:59 +0100] info [webmaild] 177.23.88.237 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-31 09:05:17 dovecot_login authenticator failed for ([103.190.91.113]) [103.190.91.113]:50601: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-31 09:04:43 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:30504: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 31 09:05:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 31 09:05:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-31 09:05:31 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:64677: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.15.121
description:
Jan 31 09:05:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.15.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.50
description:
2025-01-31 09:06:07 dovecot_plain authenticator failed for ([61.185.68.50]) [61.185.68.50]:53290: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
description:
2025-01-31 09:06:11 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:48202: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.95
description:
2025-01-31 09:06:33 dovecot_plain authenticator failed for (95-179-53-194.mairnet.net) [194.53.179.95]:48065: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 31 09:05:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.255.15.121
description:
2025-01-31 09:05:50 dovecot_login authenticator failed for ([103.255.15.121]) [103.255.15.121]:59494: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Jan 31 09:05:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-31 09:06:03 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:28052: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 31 09:06:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.233.71.179
description:
Jan 31 09:06:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.233.71.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.244.68.3
description:
2025-01-31 09:05:43 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:55898: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 31 09:05:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 31 09:06:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.205.18.249
description:
Jan 31 09:06:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.205.18.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.233.71.179
description:
2025-01-31 09:06:22 dovecot_login authenticator failed for ([127.0.0.1]) [222.233.71.179]:55886: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-31 09:05:59 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:6442: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-31 09:06:24 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:45074: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Jan 31 09:06:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-01-31 09:06:28 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:64677: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.205.18.249
description:
2025-01-31 09:06:09 dovecot_login authenticator failed for ([127.0.0.1]) [185.205.18.249]:54128: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
description:
Jan 31 09:06:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.50
description:
Jan 31 09:06:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-31 09:06:16 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:9065: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 31 09:06:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
description:
2025-01-31 09:06:34 dovecot_plain authenticator failed for ([180.149.214.193]) [110.38.70.172]:19511: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-01-31 09:05:56 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:38654: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 31 09:06:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.95
description:
Jan 31 09:06:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 31 09:06:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-01-31 09:06:48 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:33608: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.49.14
description:
Jan 31 09:06:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.49.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
description:
2025-01-31 09:06:42 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:33482: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.85
description:
Jan 31 09:07:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 31 09:06:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-31 09:06:50 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:41459: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
description:
2025-01-31 09:06:38 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:48639: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Jan 31 09:06:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.197.86
description:
[2025-01-31 09:07:02 +0100] info [webmaild] 177.91.197.86 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.27.158.165
description:
Jan 31 09:07:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.27.158.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-31 09:08:33 dovecot_login authenticator failed for ([182.76.125.171]) [182.76.87.90]:46286: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-31 09:07:48 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:52061: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.21.254.67
description:
Jan 31 09:07:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.21.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.85
description:
2025-01-31 09:07:37 dovecot_login authenticator failed for ([127.0.0.1]) [183.220.247.85]:41026: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.27.158.165
description:
2025-01-31 09:07:42 dovecot_plain authenticator failed for host-87-27-158-165.business.telecomitalia.it [87.27.158.165]:48979: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 31 09:07:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 31 09:08:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.255.249.12
description:
[2025-01-31 09:07:44 +0100] info [webmaild] 149.255.249.12 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.21.254.67
description:
2025-01-31 09:07:56 dovecot_login authenticator failed for ([127.0.0.1]) [37.21.254.67]:48039: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-01-31 09:08:06 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:62621: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.242.183
description:
[2025-01-31 09:07:45 +0100] info [webmaild] 45.230.242.183 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Jan 31 09:08:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.96.101.195
description:
[2025-01-31 09:08:31 +0100] info [webmaild] 190.96.101.195 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 31 09:09:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-31 09:09:30 dovecot_login authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:44265: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 09:08:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Jan 31 09:08:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-31 09:08:56 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:57460: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-01-31 09:08:56 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:34166: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
description:
Jan 31 09:09:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
description:
Jan 31 09:09:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 31 09:09:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-31 09:08:39 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:1593: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 31 09:09:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 31 09:08:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
description:
2025-01-31 09:09:21 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:60118: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-31 09:09:34 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:35061: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 31 09:08:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Jan 31 09:09:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
description:
Jan 31 09:09:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-01-31 09:09:19 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:54076: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-31 09:09:21 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:46330: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
description:
2025-01-31 09:09:31 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:51580: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 31 09:08:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-31 09:08:56 dovecot_login authenticator failed for (nsg-static-170.125.76.182-airtel.com) [182.76.87.90]:38348: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-31 09:09:43 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:46376: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 31 09:10:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
description:
2025-01-31 09:09:43 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:38264: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Jan 31 09:10:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.196.55.141
description:
[2025-01-31 09:10:25 +0100] info [webmaild] 91.196.55.141 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Jan 31 09:09:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 31 09:09:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-31 09:10:34 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:38294: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-31 09:09:36 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:57140: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-01-31 09:09:47 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:36470: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-01-31 09:09:58 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:39128: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-01-31 09:10:05 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.250.139]:11976: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Jan 31 09:09:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-31 09:09:58 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:51561: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.180.102
description:
2025-01-31 09:10:08 dovecot_plain authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:50700: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
description:
Jan 31 09:09:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 31 09:10:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-31 09:10:35 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:44896: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 31 09:09:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.226.4.27
description:
2025-01-31 09:09:51 dovecot_login authenticator failed for ([41.226.4.27]) [41.226.4.27]:52590: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.250.139
description:
Jan 31 09:10:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-01-31 09:10:19 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:59579: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-01-31 09:10:19 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:35421: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.226.4.27
description:
Jan 31 09:09:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.226.4.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.195.198
description:
2025-01-31 09:10:50 dovecot_plain authenticator failed for ([221.10.195.198]) [221.10.195.198]:42300: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-01-31 09:10:55 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:42700: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.183.65.36
description:
2025-01-31 09:10:46 dovecot_login authenticator failed for ([59.183.65.36]) [59.183.65.36]:58119: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.195.198
description:
Jan 31 09:10:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.135.6.10
description:
Jan 31 09:10:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.135.6.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 31 09:11:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Jan 31 09:11:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 31 09:10:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Jan 31 09:10:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.6.246
description:
[2025-01-31 09:11:08 +0100] info [webmaild] 45.226.6.246 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-31 09:11:31 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:59452: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-31 09:10:38 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:57452: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.183.65.36
description:
Jan 31 09:10:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.183.65.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
description:
2025-01-31 09:10:59 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:36986: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.247.184
description:
[2025-01-31 09:11:12 +0100] info [webmaild] 177.105.247.184 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
description:
Jan 31 09:11:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-01-31 09:11:49 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:51730: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
description:
2025-01-31 09:11:50 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:46240: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.234.29.188
description:
[2025-01-31 09:11:55 +0100] info [webmaild] 41.234.29.188 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Jan 31 09:11:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Jan 31 09:11:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-31 09:11:41 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:55902: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
description:
Jan 31 09:12:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
description:
2025-01-31 09:12:02 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:54926: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-01-31 09:11:36 dovecot_plain authenticator failed for ([78.108.186.10]) [78.108.186.10]:57218: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-31 09:13:06 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:54130: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
description:
2025-01-31 09:13:09 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:52080: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-01-31 09:13:20 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:64872: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.199.245
description:
2025-01-31 09:13:32 dovecot_login authenticator failed for 5.185.199.245.ipv4.public.orange.pl [5.185.199.245]:51348: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-01-31 09:12:44 dovecot_login authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:51232: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-31 09:12:57 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:54465: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 31 09:13:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-01-31 09:12:41 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:40182: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 31 09:12:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Jan 31 09:13:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-01-31 09:13:29 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:57478: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.199.245
description:
Jan 31 09:13:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.199.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Jan 31 09:12:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Jan 31 09:12:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
description:
Jan 31 09:13:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Jan 31 09:13:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 31 09:14:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 31 09:14:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.152.26
description:
Jan 31 09:13:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.152.26 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 31 09:14:03 ait sshd[1450372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-31 09:13:49 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:45716: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.206.105.42
description:
2025-01-31 09:14:24 dovecot_plain authenticator failed for ([10.13.72.77]) [195.206.105.42]:65489: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.31.83
description:
2025-01-31 09:14:29 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.31.83]:60532: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-31 09:13:43 dovecot_login authenticator failed for ([147.235.97.158]) [147.235.97.158]:18111: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-01-31 09:14:24 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:49260: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-01-31 09:14:30 dovecot_plain authenticator failed for ([24.187.213.29]) [24.187.213.29]:52494: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 31 09:13:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-01-31 09:13:44 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:47710: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
description:
Jan 31 09:13:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 31 09:14:03 ait sshd[1450372]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 31 09:13:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
description:
2025-01-31 09:13:55 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:49055: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.99.96.175
description:
[2025-01-31 09:13:58 +0100] info [webmaild] 92.99.96.175 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Jan 31 09:14:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.31.83
description:
Jan 31 09:14:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.31.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
description:
Jan 31 09:13:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.152.26
description:
2025-01-31 09:13:42 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.152.26]:58398: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Jan 31 09:14:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-31 09:14:29 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:39318: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 31 09:14:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-31 09:14:06 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:52740: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-31 09:14:29 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:51399: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.21.115.28
description:
[2025-01-31 09:14:59 +0100] info [webmaild] 187.21.115.28 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
description:
2025-01-31 09:15:22 dovecot_plain authenticator failed for ([83.239.171.226]) [83.239.171.226]:55326: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
description:
2025-01-31 09:14:40 dovecot_login authenticator failed for ([127.0.0.1]) [175.214.52.214]:57442: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 31 09:14:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.181.241.18
description:
Jan 31 09:14:44 ait sshd[1450577]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.181.241.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.63.208
description:
2025-01-31 09:14:50 dovecot_plain authenticator failed for ([119.207.63.208]) [119.207.63.208]:54119: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 31 09:15:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-31 09:14:46 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:45132: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 31 09:14:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.63.208
description:
Jan 31 09:14:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.63.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 09:15:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-31 09:15:13 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:42013: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-31 09:14:48 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:52456: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.72.131
description:
Jan 31 09:14:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.72.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.72.131
description:
2025-01-31 09:14:38 dovecot_login authenticator failed for ([127.0.0.1]) [178.66.72.131]:36496: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
description:
Jan 31 09:14:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.155.93.172
description:
[2025-01-31 09:14:40 +0100] info [webmaild] 105.155.93.172 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.181.241.18
description:
Jan 31 09:14:44 ait sshd[1450577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.181.241.18


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-14.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.171.226
description:
Jan 31 09:15:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.171.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 31 09:16:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.63.208
description:
Jan 31 09:16:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.63.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-01-31 09:15:43 dovecot_plain authenticator failed for ([177.174.122.213]) [177.174.122.213]:39615: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.206.105.42
description:
2025-01-31 09:15:53 dovecot_plain authenticator failed for ([10.13.72.77]) [195.206.105.42]:56813: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.219.90
description:
2025-01-31 09:15:55 dovecot_plain authenticator failed for ([183.237.219.90]) [183.237.219.90]:57986: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-01-31 09:16:08 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:38303: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Jan 31 09:15:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.59.13
description:
[2025-01-31 09:15:47 +0100] info [webmaild] 181.199.59.13 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 31 09:15:58 ait sshd[1451325]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
description:
Jan 31 09:16:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
description:
2025-01-31 09:16:02 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:34421: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Jan 31 09:16:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.219.90
description:
Jan 31 09:15:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 31 09:15:58 ait sshd[1451325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-31 09:16:37 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:52807: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 31 09:16:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
description:
Jan 31 09:16:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.67.80
description:
[2025-01-31 09:17:22 +0100] info [webmaild] 170.233.67.80 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.63.208
description:
2025-01-31 09:16:37 dovecot_plain authenticator failed for ([119.207.63.208]) [119.207.63.208]:56071: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Jan 31 09:16:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Jan 31 09:17:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-01-31 09:17:12 dovecot_plain authenticator failed for ([78.108.186.10]) [78.108.186.10]:39940: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 31 09:17:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 31 09:16:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
description:
Jan 31 09:16:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-31 09:16:57 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:42292: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
description:
2025-01-31 09:17:12 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:51110: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
description:
Jan 31 09:17:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-31 09:17:16 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:59922: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
description:
2025-01-31 09:16:59 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:36675: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 31 09:17:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
description:
2025-01-31 09:16:56 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:38840: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-31 09:17:27 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:21416: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-31 09:16:49 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:57826: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-01-31 09:16:58 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:45036: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.10.71.79
description:
[2025-01-31 09:18:04 +0100] info [webmaild] 197.10.71.79 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 09:18:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.181.241.18
description:
Jan 31 09:18:34 ait sshd[1451992]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.181.241.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
description:
Jan 31 09:17:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
description:
2025-01-31 09:17:46 dovecot_plain authenticator failed for ([58.18.88.146]) [58.18.88.146]:34994: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
description:
Jan 31 09:17:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
description:
2025-01-31 09:17:56 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:57210: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.181.241.18
description:
Jan 31 09:18:34 ait sshd[1451992]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.181.241.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
description:
Jan 31 09:17:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
description:
2025-01-31 09:17:46 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:54097: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
description:
Jan 31 09:18:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
description:
2025-01-31 09:18:33 dovecot_plain authenticator failed for ([223.100.248.64]) [223.100.248.64]:59206: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.134.46
description:
[2025-01-31 09:18:23 +0100] info [webmaild] 170.78.134.46 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-31 09:19:05 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:62232: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-31 09:19:18 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:33288: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.181.241.18
description:
Jan 31 09:18:36 ait sshd[1451992]: Disconnected from invalid user guest 61.181.241.18 port 47454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-31 09:19:05 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:28653: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.135.229
description:
[2025-01-31 09:19:10 +0100] info [webmaild] 177.131.135.229 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 31 09:19:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-31 09:19:27 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:55633: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 31 09:19:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 31 09:19:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-31 09:19:04 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:51141: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 31 09:19:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 31 09:19:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-31 09:19:18 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:54636: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-31 09:19:20 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:58887: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 31 09:19:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
description:
Jan 31 09:19:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 31 09:19:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
description:
2025-01-31 09:19:18 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:35876: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-31 09:19:33 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:38880: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.191.71.148
description:
Jan 31 09:19:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.191.71.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.191.71.148
description:
2025-01-31 09:19:36 dovecot_login authenticator failed for ([127.0.0.1]) [113.191.71.148]:59983: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 31 09:19:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
description:
2025-01-31 09:20:09 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:40130: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.24.137.112
description:
Jan 31 09:20:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.24.137.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.24.137.112
description:
2025-01-31 09:20:18 dovecot_login authenticator failed for ([127.0.0.1]) [123.24.137.112]:60437: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 31 09:20:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 09:19:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.186.33.55
description:
2025-01-31 09:19:43 dovecot_plain authenticator failed for (h55.33.186.173.dynamic.ip.windstream.net) [173.186.33.55]:42332: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.235.221.208
description:
Jan 31 09:19:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.235.221.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.221.208
description:
2025-01-31 09:19:47 dovecot_plain authenticator failed for ([186.235.221.208]) [186.235.221.208]:47905: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 31 09:20:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.123.128.195
description:
Jan 31 09:20:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.123.128.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.247.249.10
description:
Jan 31 09:20:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.247.249.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.247.249.10
description:
2025-01-31 09:20:32 dovecot_login authenticator failed for ([61.247.249.10]) [61.247.249.10]:60934: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
description:
2025-01-31 09:20:33 dovecot_plain authenticator failed for ([45.65.68.104]) [45.65.68.104]:40284: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-31 09:20:22 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:48398: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
description:
Jan 31 09:20:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-31 09:20:25 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:41882: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
description:
Jan 31 09:20:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.186.33.55
description:
Jan 31 09:19:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.186.33.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 31 09:20:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-31 09:20:20 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:44818: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
description:
2025-01-31 09:20:26 dovecot_plain authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:51569: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.123.128.195
description:
2025-01-31 09:20:28 dovecot_login authenticator failed for ([127.0.0.1]) [175.123.128.195]:51773: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Jan 31 09:21:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-01-31 09:21:29 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:43176: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 31 09:20:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Jan 31 09:21:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Jan 31 09:21:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-01-31 09:21:16 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:52012: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-01-31 09:20:39 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:38510: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-01-31 09:20:44 dovecot_login authenticator failed for ([185.113.49.23]) [185.113.49.23]:43887: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-01-31 09:21:09 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:33692: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Jan 31 09:20:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 09:20:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.220.37.83
description:
[2025-01-31 09:20:56 +0100] info [webmaild] 186.220.37.83 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.66.249.234
description:
2025-01-31 09:20:56 dovecot_plain authenticator failed for 92-66-249-234.biz.kpn.net [92.66.249.234]:43278: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
description:
Jan 31 09:20:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.66.249.234
description:
Jan 31 09:20:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.66.249.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-31 09:21:01 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:36992: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.166.242.89
description:
[2025-01-31 09:21:55 +0100] info [webmaild] 190.166.242.89 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 31 09:21:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 31 09:22:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-31 09:22:05 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:47327: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 31 09:22:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-31 09:22:27 dovecot_login authenticator failed for ([211.105.223.49]) [211.105.223.49]:39382: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Jan 31 09:21:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
description:
Jan 31 09:22:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-01-31 09:22:30 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:34842: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-31 09:21:39 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:35651: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-01-31 09:21:49 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:33867: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Jan 31 09:22:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-01-31 09:22:29 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:39582: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.214.221
description:
[2025-01-31 09:21:43 +0100] info [webmaild] 138.97.214.221 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 31 09:23:16 ait sshd[1454362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
description:
Jan 31 09:23:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Jan 31 09:23:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 31 09:23:16 ait sshd[1454362]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-01-31 09:23:07 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:47487: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.97.172.217
description:
Jan 31 09:23:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.97.172.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 31 09:23:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.244.68.3
description:
2025-01-31 09:23:23 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:30639: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 31 09:23:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 31 09:22:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 31 09:23:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.97.172.217
description:
2025-01-31 09:23:20 dovecot_login authenticator failed for vmi2403972.contaboserver.net ([127.0.0.1]) [161.97.172.217]:47974: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 31 09:22:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Jan 31 09:23:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
description:
2025-01-31 09:23:09 dovecot_login authenticator failed for ([111.61.176.243]) [111.61.176.243]:32988: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 31 09:23:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
description:
2025-01-31 09:23:32 dovecot_login authenticator failed for ([127.0.0.1]) [183.220.65.21]:47852: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-31 09:22:47 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:59752: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 31 09:23:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-01-31 09:23:09 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br [186.247.192.94]:45126: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-31 09:23:20 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:60773: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Jan 31 09:22:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-01-31 09:22:53 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:36822: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 31 09:22:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-31 09:22:44 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:58458: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.47.214
description:
[2025-01-31 09:22:57 +0100] info [webmaild] 103.151.47.214 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-31 09:23:31 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:57528: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
description:
2025-01-31 09:24:20 dovecot_login authenticator failed for 136.169.144.176.dynamic.ufanet.ru ([127.0.0.1]) [136.169.144.176]:55744: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.109.130.238
description:
Jan 31 09:24:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.109.130.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.109.130.238
description:
2025-01-31 09:24:27 dovecot_login authenticator failed for ([127.0.0.1]) [70.109.130.238]:57081: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 31 09:23:56 ait sshd[1454497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 31 09:23:56 ait sshd[1454497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
description:
2025-01-31 09:24:05 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:36327: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 31 09:24:11 ait sshd[1454716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
description:
Jan 31 09:24:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 09:23:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 31 09:24:11 ait sshd[1454716]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-01-31 09:24:26 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:35141: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.119.194
description:
Jan 31 09:24:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.24.68
description:
Jan 31 09:23:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.24.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.148.106
description:
Jan 31 09:24:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.148.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
description:
Jan 31 09:24:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
description:
2025-01-31 09:24:15 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:35940: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Jan 31 09:24:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.24.68
description:
2025-01-31 09:23:55 dovecot_login authenticator failed for syn-173-095-024-068.biz.spectrum.com [173.95.24.68]:1415: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 31 09:24:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-31 09:24:19 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:7781: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.119.194
description:
2025-01-31 09:24:33 dovecot_plain authenticator failed for ([113.57.119.194]) [113.57.119.194]:13260: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 31 09:24:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Jan 31 09:25:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.39.35
description:
[2025-01-31 09:25:30 +0100] info [webmaild] 170.81.39.35 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.130.22
description:
2025-01-31 09:24:43 dovecot_plain authenticator failed for ([58.58.130.22]) [58.58.130.22]:42718: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 31 09:25:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-31 09:25:14 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:28322: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 31 09:24:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-31 09:24:57 dovecot_plain authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:13339: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 31 09:24:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.45
description:
2025-01-31 09:25:10 dovecot_login authenticator failed for (ADMIN) [138.199.59.45]:59840: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.157.32.129
description:
2025-01-31 09:25:21 dovecot_login authenticator failed for ([41.157.32.129]) [41.157.32.129]:40106: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 31 09:24:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.130.22
description:
Jan 31 09:24:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.130.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-31 09:24:41 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:53212: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-31 09:25:01 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:52246: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.157.32.129
description:
Jan 31 09:25:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.157.32.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-31 09:24:37 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (yofte) [91.56.31.167]:60992: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.100.70
description:
[2025-01-31 09:24:47 +0100] info [webmaild] 186.235.100.70 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.169.62
description:
Jan 31 09:25:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.169.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 31 09:25:59 ait sshd[1455587]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.53.126.112
description:
Jan 31 09:25:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.53.126.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-01-31 09:26:04 dovecot_plain authenticator failed for ([202.53.94.242]) [202.53.94.242]:59172: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 09:26:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 31 09:26:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.238.181
description:
[2025-01-31 09:25:42 +0100] info [webmaild] 45.170.238.181 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 31 09:25:59 ait sshd[1455587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Jan 31 09:25:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.53.126.112
description:
2025-01-31 09:25:52 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:33274: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Jan 31 09:26:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 09:26:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.48.249
description:
[2025-01-31 09:26:30 +0100] info [webmaild] 186.219.48.249 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-31 09:26:29 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:38378: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
description:
Jan 31 09:27:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
description:
2025-01-31 09:27:25 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:52211: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-31 09:27:28 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:35244: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-01-31 09:26:40 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:29681: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.138
description:
2025-01-31 09:27:17 dovecot_plain authenticator failed for ([121.202.155.138]) [121.202.155.138]:30696: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 31 09:27:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Jan 31 09:26:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.138
description:
Jan 31 09:27:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 31 09:28:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.120.149.246
description:
[2025-01-31 09:28:29 +0100] info [webmaild] 196.120.149.246 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-31 09:27:41 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:35744: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-31 09:27:59 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:17659: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-31 09:28:26 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:49534: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
description:
Jan 31 09:28:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-31 09:28:18 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:51995: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 31 09:27:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 31 09:28:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 31 09:28:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-31 09:28:16 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:57109: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 31 09:28:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Jan 31 09:27:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-01-31 09:27:48 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:46626: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-28.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 31 09:28:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
description:
2025-01-31 09:28:34 dovecot_plain authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:38273: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 31 09:27:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Jan 31 09:27:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-31 09:28:49 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:59074: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
description:
Jan 31 09:28:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.37.50.133
description:
[2025-01-31 09:29:13 +0100] info [webmaild] 179.37.50.133 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 31 09:28:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 31 09:28:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-31 09:28:46 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:49842: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-31 09:28:47 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:35914: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Jan 31 09:28:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-01-31 09:29:01 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:60518: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 31 09:29:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 31 09:28:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
description:
2025-01-31 09:28:52 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:49709: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 31 09:28:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 31 09:28:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.34.26
description:
2025-01-31 09:28:58 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:34121: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-31 09:29:05 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:40649: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-31 09:29:11 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:49506: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-31 09:28:58 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:39706: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 31 09:29:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.142.65.55
description:
[2025-01-31 09:29:18 +0100] info [webmaild] 190.142.65.55 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.166
description:
2025-01-31 09:29:58 dovecot_login authenticator failed for 166.46.246.220.static.netvigator.com ([127.0.0.1]) [220.246.46.166]:61228: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-31 09:30:08 dovecot_login authenticator failed for (m121-202-152-165.smartone.com) [121.202.152.165]:27598: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.186
description:
2025-01-31 09:29:53 dovecot_login authenticator failed for ([111.61.177.186]) [111.61.177.186]:37268: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.143.77.111
description:
2025-01-31 09:29:54 dovecot_login authenticator failed for ([220.189.239.206]) [183.143.77.111]:49708: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.96.2
description:
2025-01-31 09:29:48 dovecot_login authenticator failed for ([127.0.0.1]) [207.102.96.2]:58108: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.166
description:
Jan 31 09:29:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 31 09:30:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.96.2
description:
Jan 31 09:29:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.96.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.182.139.25
description:
[2025-01-31 09:30:07 +0100] info [webmaild] 182.182.139.25 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.143.77.111
description:
Jan 31 09:29:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.143.77.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-31 09:30:31 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:41217: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 31 09:29:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-31 09:29:40 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:48948: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.186
description:
Jan 31 09:29:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 31 09:31:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-31 09:31:02 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:47610: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 31 09:31:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.226.4.27
description:
2025-01-31 09:31:20 dovecot_login authenticator failed for ([41.226.4.27]) [41.226.4.27]:59474: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-31 09:31:25 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:37188: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-31 09:31:30 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:44952: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 31 09:31:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Jan 31 09:31:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
description:
Jan 31 09:31:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-31 09:31:11 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:45743: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
description:
Jan 31 09:30:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.184.53.83
description:
Jan 31 09:31:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.184.53.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 31 09:31:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-01-31 09:31:05 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:44414: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-01-31 09:31:06 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:54356: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-31 09:31:20 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:24214: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-01-31 09:30:51 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:51051: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-31 09:31:05 dovecot_plain authenticator failed for (almon) [62.231.31.86]:48973: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.83.22
description:
Jan 31 09:31:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.83.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Jan 31 09:30:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 31 09:31:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.83.22
description:
2025-01-31 09:31:19 dovecot_plain authenticator failed for (2-54-83-22.orange.net.il) [2.54.83.22]:37050: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Jan 31 09:31:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Jan 31 09:31:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
description:
2025-01-31 09:31:10 dovecot_plain authenticator failed for ([46.45.218.48]) [46.45.218.48]:49282: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.226.4.27
description:
Jan 31 09:31:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.226.4.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.184.53.83
description:
2025-01-31 09:31:21 dovecot_plain authenticator failed for (default-rdns.vocus.co.nz) [203.184.53.83]:43429: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.209.153
description:
2025-01-31 09:31:01 dovecot_login authenticator failed for ([39.174.209.153]) [39.174.209.153]:43578: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
description:
Jan 31 09:31:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.181.241.18
description:
Jan 31 09:32:26 ait sshd[1458397]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.181.241.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
description:
2025-01-31 09:31:53 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:33818: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.16.162.62
description:
[2025-01-31 09:32:00 +0100] info [webmaild] 165.16.162.62 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Jan 31 09:32:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
description:
Jan 31 09:32:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
description:
2025-01-31 09:32:20 dovecot_login authenticator failed for (sole2-029.alida.it) [130.255.96.29]:5281: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-01-31 09:32:32 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:36896: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.232.184
description:
Jan 31 09:31:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.232.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 31 09:32:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.156.80.230
description:
2025-01-31 09:32:24 dovecot_login authenticator failed for ([117.156.80.230]) [117.156.80.230]:59652: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.181.210.18
description:
2025-01-31 09:31:39 dovecot_plain authenticator failed for ([216.181.210.18]) [216.181.210.18]:39066: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-01-31 09:31:39 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:47872: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.123.208.246
description:
Jan 31 09:32:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.123.208.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.123.208.246
description:
2025-01-31 09:32:28 dovecot_login authenticator failed for 246.208.123.34.bc.googleusercontent.com [34.123.208.246]:57666: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Jan 31 09:32:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.181.210.18
description:
Jan 31 09:31:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.181.210.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 31 09:31:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
description:
Jan 31 09:31:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
description:
2025-01-31 09:31:54 dovecot_plain authenticator failed for ([120.234.232.184]) [120.234.232.184]:23248: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 31 09:32:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.234
description:
Jan 31 09:32:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-31 09:32:03 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:37949: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.202.15.69
description:
Jan 31 09:32:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.202.15.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.255.96.29
description:
Jan 31 09:32:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.255.96.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-31 09:32:20 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:58102: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.156.80.230
description:
Jan 31 09:32:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.156.80.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.181.241.18
description:
Jan 31 09:32:26 ait sshd[1458397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.181.241.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Jan 31 09:31:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-31 09:31:50 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:41381: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 31 09:31:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
description:
2025-01-31 09:32:05 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:50831: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
description:
2025-01-31 09:32:07 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:53060: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-31 09:32:40 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:56634: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.237.34.138
description:
[2025-01-31 09:32:52 +0100] info [webmaild] 190.237.34.138 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.246.91
description:
2025-01-31 09:33:07 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:54294: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 09:33:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
description:
Jan 31 09:33:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Jan 31 09:33:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 31 09:32:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-31 09:32:47 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:48116: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 31 09:33:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
description:
2025-01-31 09:33:33 dovecot_plain authenticator failed for ([83.239.171.226]) [83.239.171.226]:51068: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.146.189.117
description:
[2025-01-31 09:32:43 +0100] info [webmaild] 194.146.189.117 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-01-31 09:33:18 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:37272: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 31 09:32:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Jan 31 09:33:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
description:
2025-01-31 09:33:21 dovecot_login authenticator failed for ([111.61.87.152]) [111.61.87.152]:20860: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.171.226
description:
Jan 31 09:33:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.171.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-01-31 09:33:35 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:51061: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.201.42
description:
2025-01-31 09:33:51 dovecot_plain authenticator failed for ([103.93.201.42]) [103.93.201.42]:57397: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-31 09:34:08 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:54014: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-31 09:34:14 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (molosang) [81.143.51.58]:50192: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.17.51
description:
Jan 31 09:33:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.17.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Jan 31 09:34:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 09:34:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.94.78
description:
[2025-01-31 09:33:37 +0100] info [webmaild] 188.163.94.78 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 31 09:34:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 09:34:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.201.42
description:
Jan 31 09:33:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.201.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.54.70.126
description:
Jan 31 09:33:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.54.70.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.70.126
description:
2025-01-31 09:34:01 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.70.126]:41852: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-01-31 09:34:05 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:43019: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 31 09:34:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 31 09:34:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-31 09:34:19 dovecot_plain authenticator failed for (mided) [164.92.243.206]:52876: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.3.17.51
description:
2025-01-31 09:33:47 dovecot_login authenticator failed for ([61.3.17.51]) [61.3.17.51]:58831: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-01-31 09:35:16 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:56950: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-31 09:34:53 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:35196: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.234
description:
Jan 31 09:35:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.234
description:
2025-01-31 09:35:06 dovecot_plain authenticator failed for ([61.185.226.234]) [61.185.226.234]:46703: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.242.250
description:
[2025-01-31 09:35:33 +0100] info [webmaild] 170.233.242.250 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 31 09:35:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 31 09:34:38 ait sshd[1459083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-01-31 09:34:58 dovecot_plain authenticator failed for (wherstace) [89.109.233.181]:35038: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 31 09:34:38 ait sshd[1459083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Jan 31 09:35:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 31 09:34:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Jan 31 09:34:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 31 09:35:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
description:
Jan 31 09:35:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-01-31 09:35:41 dovecot_login authenticator failed for ([185.113.49.23]) [185.113.49.23]:60114: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.16.115
description:
Jan 31 09:35:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.54.16.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Jan 31 09:36:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.122.153.123
description:
[2025-01-31 09:36:16 +0100] info [webmaild] 37.122.153.123 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
description:
2025-01-31 09:36:22 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:28062: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-31 09:35:37 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:22056: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Jan 31 09:35:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.161.98.181
description:
2025-01-31 09:36:16 dovecot_plain authenticator failed for ([119.161.97.235]) [119.161.98.181]:33192: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-31 09:35:40 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:60078: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 31 09:35:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-31 09:35:54 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:41535: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.16.115
description:
2025-01-31 09:35:57 dovecot_plain authenticator failed for playmail20191.fvds.ru [103.54.16.115]:44016: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-01-31 09:35:59 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:47113: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.161.98.181
description:
Jan 31 09:36:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.161.98.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.38.154
description:
[2025-01-31 09:36:17 +0100] info [webmaild] 179.127.38.154 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-01-31 09:36:16 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:54494: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
description:
Jan 31 09:36:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 31 09:36:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-31 09:36:27 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:55270: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-31 09:36:47 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:37365: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
description:
Jan 31 09:37:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
description:
2025-01-31 09:37:35 dovecot_plain authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:31075: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.131.79
description:
Jan 31 09:36:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.131.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
description:
2025-01-31 09:37:17 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:62001: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.199.119
description:
Jan 31 09:37:10 ait sshd[1460224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.199.119  user=games


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 31 09:37:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.247.54
description:
Jan 31 09:36:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.247.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.199.119
description:
Jan 31 09:37:10 ait sshd[1460224]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.199.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-31 09:37:21 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:54782: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 09:36:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.97.119.38
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:abs18a00023y@ait.edu.gh||WPU:abs18a00023y@ait.edu.gh||RSV:6.65||T:APACHE||MV:09-37.83.97.119.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
description:
2025-01-31 09:37:05 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:33871: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.210.180
description:
Jan 31 09:37:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.210.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 31 09:37:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.31
description:
Jan 31 09:37:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.131.79
description:
2025-01-31 09:37:00 dovecot_plain authenticator failed for ([111.53.131.79]) [111.53.131.79]:60228: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
description:
2025-01-31 09:37:01 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:49090: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.74.187
description:
Jan 31 09:36:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.74.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.247.54
description:
2025-01-31 09:36:58 dovecot_plain authenticator failed for ([82.209.247.54]) [82.209.247.54]:37636: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-31 09:37:26 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:37608: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Jan 31 09:36:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.251.109
description:
[2025-01-31 09:37:05 +0100] info [webmaild] 177.91.251.109 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-31 09:37:46 dovecot_plain authenticator failed for ([94.43.224.106]) [2.57.219.2]:51910: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-01-31 09:38:06 dovecot_login authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:34281: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 31 09:37:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.210.8.69
description:
Jan 31 09:37:37 ait sshd[1460440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.210.8.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 09:37:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 31 09:37:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.165.182
description:
Jan 31 09:38:06 ait sshd[1460601]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.165.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.165.182
description:
Jan 31 09:38:06 ait sshd[1460601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.165.182


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.210.8.69
description:
Jan 31 09:37:37 ait sshd[1460440]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.210.8.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-31 09:37:39 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:44801: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Jan 31 09:38:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 92.53.96.165
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:09-39.92.53.96.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Jan 31 09:39:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.111
description:
2025-01-31 09:39:11 dovecot_plain authenticator failed for ([14.21.36.111]) [14.21.36.111]:50135: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 09:39:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-01-31 09:39:23 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:35639: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.156.234.108
description:
[2025-01-31 09:39:03 +0100] info [webmaild] 105.156.234.108 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.184.114
description:
2025-01-31 09:39:25 dovecot_plain authenticator failed for ([163.142.184.114]) [163.142.184.114]:33387: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.14
description:
Jan 31 09:38:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.14
description:
2025-01-31 09:38:40 dovecot_login authenticator failed for ([188.59.178.14]) [188.59.178.14]:54594: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-01-31 09:39:11 dovecot_plain authenticator failed for ([1.180.230.98]) [1.180.230.98]:50737: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Jan 31 09:39:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.184.114
description:
Jan 31 09:39:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.184.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.249.36.3
description:
Jan 31 09:38:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.249.36.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.249.36.3
description:
2025-01-31 09:38:59 dovecot_plain authenticator failed for ([183.71.251.66]) [113.249.36.3]:19020: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.21.36.111
description:
Jan 31 09:39:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.21.36.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 31 09:40:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.83.205
description:
2025-01-31 09:39:52 dovecot_plain authenticator failed for ([58.18.83.205]) [58.18.83.205]:59177: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
description:
2025-01-31 09:40:05 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:48630: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.210.8.69
description:
Jan 31 09:40:08 ait sshd[1461580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.210.8.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-01-31 09:40:13 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:58770: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 31 09:40:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.82.131.20
description:
2025-01-31 09:39:49 dovecot_login authenticator failed for ([184.82.131.20]) [184.82.131.20]:36764: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Jan 31 09:39:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.107.135
description:
2025-01-31 09:40:07 dovecot_plain authenticator failed for ([222.85.107.135]) [222.85.107.135]:44647: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.64.153
description:
[2025-01-31 09:39:46 +0100] info [webmaild] 131.196.64.153 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-01-31 09:40:32 dovecot_login authenticator failed for ([210.12.68.242]) [210.12.68.242]:34470: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.47
description:
2025-01-31 09:40:20 dovecot_login authenticator failed for 111-70-32-47.emome-ip.hinet.net [111.70.32.47]:57428: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
description:
Jan 31 09:40:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Jan 31 09:40:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.170.1.244
description:
Jan 31 09:40:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.170.1.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.82.131.20
description:
Jan 31 09:39:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.82.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.83.205
description:
Jan 31 09:39:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.210.8.69
description:
Jan 31 09:40:08 ait sshd[1461580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.210.8.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-31 09:40:28 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:46296: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 31 09:40:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.85.107.135
description:
Jan 31 09:40:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.85.107.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.47
description:
Jan 31 09:40:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Jan 31 09:39:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.184.124.19
description:
[2025-01-31 09:39:54 +0100] info [webmaild] 105.184.124.19 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-01-31 09:39:52 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:58802: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-01-31 09:39:52 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:45850: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Jan 31 09:40:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Jan 31 09:40:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.16.150.212
description:
2025-01-31 09:41:33 dovecot_plain authenticator failed for ([219.140.170.34]) [27.16.150.212]:59543: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Jan 31 09:40:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
description:
Jan 31 09:41:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 31 09:41:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-01-31 09:40:40 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:56482: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 31 09:40:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-31 09:41:29 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:51245: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.210.8.69
description:
Jan 31 09:41:30 ait sshd[1462357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.210.8.69


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.210.8.69
description:
Jan 31 09:41:30 ait sshd[1462357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.210.8.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Jan 31 09:40:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.165.182
description:
Jan 31 09:40:46 ait sshd[1462047]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.165.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-01-31 09:40:53 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:37984: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
description:
2025-01-31 09:41:19 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:51495: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-41.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.16.150.212
description:
Jan 31 09:41:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.16.150.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Jan 31 09:41:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-01-31 09:41:33 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:60490: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-31 09:40:48 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:44040: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.29.53
description:
2025-01-31 09:41:18 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:43342: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-01-31 09:41:13 dovecot_plain authenticator failed for ([200.125.14.122]) [200.125.14.122]:41561: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 09:41:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.210.8.69
description:
Jan 31 09:41:31 ait sshd[1462357]: Failed password for invalid user wikijs from 181.210.8.69 port 44368 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-31 09:40:37 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:60881: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 31 09:40:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
description:
Jan 31 09:41:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 31 09:41:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.219.225.231
description:
[2025-01-31 09:40:42 +0100] info [webmaild] 103.219.225.231 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.165.182
description:
Jan 31 09:40:46 ait sshd[1462047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.165.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
description:
Jan 31 09:41:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.78
description:
Jan 31 09:41:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.30.162.58
description:
Jan 31 09:41:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.30.162.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.30.162.58
description:
2025-01-31 09:41:59 dovecot_plain authenticator failed for ([60.30.162.58]) [60.30.162.58]:53595: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
description:
2025-01-31 09:42:21 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:48193: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
description:
2025-01-31 09:41:46 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:50824: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-31 09:42:01 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:58798: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
description:
Jan 31 09:42:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.199.119
description:
Jan 31 09:41:43 ait sshd[1462443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.199.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-31 09:42:13 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:48221: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
description:
2025-01-31 09:42:15 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:52501: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.199.119
description:
Jan 31 09:41:43 ait sshd[1462443]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.199.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
description:
Jan 31 09:41:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.78
description:
2025-01-31 09:41:48 dovecot_plain authenticator failed for ([39.152.196.78]) [39.152.196.78]:35961: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Jan 31 09:42:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-01-31 09:42:35 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com [98.10.121.246]:55097: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 31 09:41:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 31 09:42:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.165.182
description:
Jan 31 09:42:10 ait sshd[1462514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.165.182


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.165.182
description:
Jan 31 09:42:10 ait sshd[1462514]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.165.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
description:
Jan 31 09:42:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 09:43:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 31 09:43:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.199.119
description:
Jan 31 09:43:31 ait sshd[1462981]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.199.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Jan 31 09:43:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 31 09:42:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-31 09:42:45 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:46006: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 31 09:42:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-31 09:43:31 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net (solls) [69.121.199.203]:33518: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.6.37
description:
[2025-01-31 09:42:50 +0100] info [webmaild] 45.237.6.37 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-31 09:42:56 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:3721: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.199.119
description:
Jan 31 09:43:31 ait sshd[1462981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.199.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.232.155
description:
2025-01-31 09:42:44 dovecot_login authenticator failed for ([104.241.232.155]) [104.241.232.155]:47425: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.219.164.104
description:
[2025-01-31 09:43:34 +0100] info [webmaild] 201.219.164.104 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.125.136
description:
[2025-01-31 09:43:48 +0100] info [webmaild] 45.238.125.136 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
description:
Jan 31 09:44:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Jan 31 09:44:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 31 09:44:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-31 09:43:57 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:44929: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-01-31 09:44:34 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:43453: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.191.172.69
description:
[2025-01-31 09:44:35 +0100] info [webmaild] 189.191.172.69 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 31 09:44:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-01-31 09:43:38 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:59243: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Jan 31 09:43:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-01-31 09:43:49 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:37541: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 31 09:43:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-31 09:44:03 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:36695: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
description:
2025-01-31 09:44:21 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:55981: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-31 09:44:37 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:63855: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
description:
Jan 31 09:44:55 ait sshd[1463324]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Jan 31 09:45:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.208.4
description:
Jan 31 09:44:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.208.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 31 09:44:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-31 09:44:50 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:58327: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
description:
Jan 31 09:44:55 ait sshd[1463324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-01-31 09:45:27 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:34178: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.208.4
description:
2025-01-31 09:44:38 dovecot_plain authenticator failed for ([103.81.208.4]) [103.81.208.4]:44958: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-31 09:44:46 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:45252: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 31 09:44:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 31 09:45:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-31 09:45:12 dovecot_plain authenticator failed for ([58.216.101.162]) [58.216.101.162]:41433: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Jan 31 09:46:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.239.144
description:
2025-01-31 09:46:15 dovecot_login authenticator failed for ([178.158.239.144]) [178.158.239.144]:39440: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-01-31 09:46:17 dovecot_plain authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:34010: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Jan 31 09:46:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
description:
2025-01-31 09:45:43 dovecot_login authenticator failed for ([102.221.65.24]) [102.221.65.24]:33591: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 31 09:45:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-31 09:45:54 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:52180: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.158.239.144
description:
Jan 31 09:46:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.158.239.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 31 09:46:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-31 09:46:06 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:40607: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.97.192
description:
[2025-01-31 09:46:26 +0100] info [webmaild] 45.228.97.192 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.145.150.234
domain: ait.edu.gh
description:
IM360 WAF: Found crawler not in whitelist||RSV:6.65||T:APACHE||RA:198.145.150.234||TA:198.145.150.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-01-31 09:46:24 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:40042: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 31 09:46:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-31 09:46:30 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:55557: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
description:
Jan 31 09:46:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.47.168.140
description:
[2025-01-31 09:47:10 +0100] info [webmaild] 177.47.168.140 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Jan 31 09:47:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-01-31 09:47:34 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:52523: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 31 09:46:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-01-31 09:46:41 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:60304: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-31 09:47:32 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:7708: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.32.93
description:
Jan 31 09:46:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.32.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 31 09:47:34 ait sshd[1464488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.35.232
description:
[2025-01-31 09:47:34 +0100] info [webmaild] 45.70.35.232 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Jan 31 09:46:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.32.93
description:
2025-01-31 09:46:50 dovecot_plain authenticator failed for ([158.140.32.93]) [158.140.32.93]:33629: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
description:
2025-01-31 09:46:53 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:45668: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 09:47:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 31 09:47:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 31 09:47:34 ait sshd[1464488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-31 09:46:39 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:40596: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 31 09:48:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 31 09:47:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-31 09:47:48 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:25257: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.30.24
description:
Jan 31 09:48:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.30.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-31 09:48:06 dovecot_plain authenticator failed for ([187.76.174.254]) [187.76.174.254]:32918: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
description:
Jan 31 09:48:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 31 09:48:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.242.120
description:
[2025-01-31 09:48:22 +0100] info [webmaild] 177.12.242.120 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-31 09:48:24 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (advimped) [62.63.230.241]:51110: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
description:
2025-01-31 09:48:28 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:40200: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.30.24
description:
2025-01-31 09:48:33 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:58530: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 09:47:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 09:48:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-31 09:48:46 dovecot_login authenticator failed for ([14.97.143.225]) [182.71.173.250]:33994: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 31 09:48:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.89.143.234
description:
Jan 31 09:48:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.89.143.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.89.143.234
description:
2025-01-31 09:48:59 dovecot_plain authenticator failed for ([222.89.143.234]) [222.89.143.234]:45602: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.226.68.250
description:
2025-01-31 09:50:07 dovecot_login authenticator failed for syn-072-226-068-250.res.spectrum.com [72.226.68.250]:56824: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.226.68.250
description:
Jan 31 09:50:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.226.68.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-31 09:50:17 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:33310: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.88.102.142
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:eng19a00089y@ait.edu.gh||WPU:eng19a00089y@ait.edu.gh||RSV:6.65||T:APACHE||MV:09-50.185.88.102.142


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.130.145.4
domain: elibrary.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:enam@unknown-domain.com||WPU:enam@unknown-domain.com||RSV:6.65||T:APACHE||MV:09-49.45.130.145.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Jan 31 09:49:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-01-31 09:49:51 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:53610: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 31 09:50:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.111.85
description:
[2025-01-31 09:50:19 +0100] info [webmaild] 45.169.111.85 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.152.176
description:
[2025-01-31 09:51:02 +0100] info [webmaild] 45.229.152.176 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 31 09:51:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-31 09:51:06 dovecot_plain authenticator failed for (persiss) [88.87.84.104]:43474: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.190.131.96
description:
[2025-01-31 09:51:15 +0100] info [webmaild] 78.190.131.96 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 09:51:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.175.252
description:
[2025-01-31 09:52:02 +0100] info [webmaild] 186.194.175.252 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 31 09:52:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 09:52:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-31 09:52:36 dovecot_login authenticator failed for ([186.200.8.115]) [186.200.249.162]:52961: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Jan 31 09:52:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-01-31 09:52:58 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:43373: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-01-31 09:53:02 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:37093: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 31 09:53:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 09:53:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.177.88.108
description:
Jan 31 09:53:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.177.88.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.211.125
description:
Jan 31 09:52:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.211.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.211.125
description:
2025-01-31 09:52:48 dovecot_login authenticator failed for ([113.64.211.125]) [113.64.211.125]:43234: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Jan 31 09:53:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 31 09:53:34 ait sshd[1467389]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 09:52:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-31 09:53:15 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38907: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 31 09:53:34 ait sshd[1467389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
description:
Jan 31 09:53:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
description:
2025-01-31 09:53:12 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:53526: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Jan 31 09:53:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-01-31 09:53:20 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:59554: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.36.134
description:
[2025-01-31 09:54:02 +0100] info [webmaild] 177.128.36.134 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
description:
Jan 31 09:54:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
description:
2025-01-31 09:54:08 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:47226: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 09:54:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Jan 31 09:53:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-01-31 09:53:46 dovecot_plain authenticator failed for ([31.41.81.24]) [31.41.81.24]:35962: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.95
description:
2025-01-31 09:53:56 dovecot_plain authenticator failed for ([194.53.179.95]) [194.53.179.95]:41598: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
description:
2025-01-31 09:54:20 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:52370: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 09:53:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-31 09:53:55 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:58561: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
description:
Jan 31 09:54:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.229.233.219
description:
Jan 31 09:53:37 ait sshd[1467389]: Failed password for invalid user rich from 156.229.233.219 port 62488 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.108
description:
2025-01-31 09:53:38 dovecot_login authenticator failed for ([186.177.88.108]) [186.177.88.108]:53289: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 31 09:53:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.95
description:
Jan 31 09:53:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.95 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-54.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Jan 31 09:54:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-01-31 09:54:52 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:53574: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.92.123
description:
[2025-01-31 09:55:02 +0100] info [webmaild] 84.54.92.123 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 31 09:55:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Jan 31 09:55:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Jan 31 09:54:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-01-31 09:54:43 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:35138: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
description:
2025-01-31 09:55:24 dovecot_plain authenticator failed for ([45.115.173.11]) [45.115.173.11]:50864: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-31 09:55:34 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:52716: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-31 09:55:18 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:42792: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.141.121.100
description:
[2025-01-31 09:54:51 +0100] info [webmaild] 200.141.121.100 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-01-31 09:54:53 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:33762: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 31 09:55:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-31 09:55:14 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:34068: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Jan 31 09:54:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-31 09:55:21 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:56294: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.115.173.11
description:
Jan 31 09:55:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.115.173.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 31 09:55:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-01-31 09:54:38 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:56293: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
description:
Jan 31 09:54:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 09:56:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-31 09:56:03 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:56358: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.104
description:
Jan 31 09:55:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.167
description:
2025-01-31 09:55:39 dovecot_login authenticator failed for (ADMIN) [179.61.240.167]:40880: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.20.130
description:
Jan 31 09:55:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.81.224.31
description:
[2025-01-31 09:55:54 +0100] info [webmaild] 154.81.224.31 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.20.130
description:
2025-01-31 09:55:54 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:56832: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 31 09:56:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 31 09:56:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
description:
2025-01-31 09:55:37 dovecot_plain authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:43642: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-31 09:56:16 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:56913: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.89.171
description:
Jan 31 09:56:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.89.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77141007
name: IM360 WAF: WordPress Plugin Duplicator File Download Auth Bypass (CVE-2020-11738)
abuser: 51.91.9.168
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Plugin Duplicator File Download Auth Bypass (CVE-2020-11738)||MVN:ARGS:file||RSV:6.65||T:APACHE||MV:../wp-config.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.89.171
description:
2025-01-31 09:56:39 dovecot_plain authenticator failed for ([2.55.89.171]) [2.55.89.171]:57692: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Jan 31 09:56:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-31 09:57:12 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:34660: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
description:
Jan 31 09:57:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-01-31 09:56:57 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:49788: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
description:
Jan 31 09:56:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
description:
2025-01-31 09:56:59 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:36135: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
description:
2025-01-31 09:57:12 dovecot_plain authenticator failed for ([177.174.88.241]) [177.174.88.241]:42568: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Jan 31 09:57:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-31 09:57:20 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:42331: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 31 09:56:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-31 09:57:01 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:49031: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 31 09:57:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.66.4.210
description:
[2025-01-31 09:57:56 +0100] info [webmaild] 105.66.4.210 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.151.238.195
description:
2025-01-31 09:58:09 dovecot_login authenticator failed for ([91.151.238.195]) [91.151.238.195]:43599: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-01-31 09:58:21 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:51964: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 31 09:58:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Jan 31 09:57:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-01-31 09:57:54 dovecot_plain authenticator failed for ([61.169.54.150]) [61.169.54.150]:40415: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.194.70
description:
2025-01-31 09:57:40 dovecot_plain authenticator failed for ([212.119.194.70]) [212.119.194.70]:51381: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
description:
Jan 31 09:58:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-31 09:58:31 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:56355: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.151.238.195
description:
Jan 31 09:58:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.151.238.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
description:
2025-01-31 09:57:51 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:53354: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 31 09:57:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-31 09:57:59 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:57398: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.119.194.70
description:
Jan 31 09:57:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.119.194.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
description:
Jan 31 09:57:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.105.217
description:
2025-01-31 09:59:42 dovecot_plain authenticator failed for ([163.179.105.217]) [163.179.105.217]:33130: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.23.100.23
description:
[2025-01-31 09:59:54 +0100] info [webmaild] 46.23.100.23 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
description:
Jan 31 10:00:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
description:
2025-01-31 10:00:03 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:34413: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.111.127
description:
2025-01-31 10:00:09 dovecot_plain authenticator failed for ([212.90.111.127]) [212.90.111.127]:47846: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
description:
2025-01-31 10:00:22 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:36490: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.105.217
description:
Jan 31 09:59:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.105.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 31 09:59:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-31 09:59:56 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:34732: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Jan 31 10:00:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Jan 31 10:00:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-01-31 10:00:13 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:51866: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.160.128.46
description:
Jan 31 10:00:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.160.128.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Jan 31 10:00:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-31 10:00:48 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:48846: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.170.20
description:
2025-01-31 10:00:55 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:52042: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.124.180
description:
Jan 31 10:01:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.124.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.124.180
description:
2025-01-31 10:01:09 dovecot_plain authenticator failed for 180.124.103.218.static.netvigator.com [218.103.124.180]:59149: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-01-31 10:00:36 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:36125: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.175.191
description:
[2025-01-31 10:01:29 +0100] info [webmaild] 45.182.175.191 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 31 10:00:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-01-31 10:00:44 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:48232: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.170.20
description:
Jan 31 10:00:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.170.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-01-31 10:00:43 dovecot_plain authenticator failed for ([201.173.16.21]) [201.173.16.21]:38108: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Jan 31 10:00:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.177.120.165
description:
2025-01-31 10:01:56 dovecot_plain authenticator failed for ([61.177.120.165]) [61.177.120.165]:42628: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Jan 31 10:02:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.89.171
description:
Jan 31 10:02:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.89.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-01-31 10:02:06 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:57350: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.61.18.6
description:
[2025-01-31 10:02:13 +0100] info [webmaild] 103.61.18.6 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
description:
Jan 31 10:02:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-31 10:02:03 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:37244: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.138
description:
Jan 31 10:02:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
description:
Jan 31 10:02:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Jan 31 10:01:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-01-31 10:01:51 dovecot_login authenticator failed for ([165.220.130.160]) [165.220.130.160]:44266: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 31 10:02:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.89.171
description:
2025-01-31 10:02:09 dovecot_plain authenticator failed for ([2.55.89.171]) [2.55.89.171]:33748: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.143.166
description:
Jan 31 10:02:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
description:
2025-01-31 10:02:33 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:56376: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.177.120.165
description:
Jan 31 10:01:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.177.120.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.138
description:
2025-01-31 10:02:06 dovecot_login authenticator failed for ([119.62.184.138]) [119.62.184.138]:43544: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
description:
2025-01-31 10:02:20 dovecot_plain authenticator failed for mail.toptronicsinc.com [218.4.156.254]:47173: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
description:
2025-01-31 10:02:34 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:51166: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.40.18.220
description:
2025-01-31 10:03:22 dovecot_login authenticator failed for (179-40-18-220.mrse.com.ar) [179.40.18.220]:54500: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.20.141
description:
[2025-01-31 10:02:38 +0100] info [webmaild] 168.205.20.141 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 31 10:03:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-01-31 10:03:24 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:39700: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.92.254.166
description:
[2025-01-31 10:03:27 +0100] info [webmaild] 81.92.254.166 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
description:
2025-01-31 10:02:41 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:39140: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 10:02:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
description:
2025-01-31 10:02:45 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:46440: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.40.18.220
description:
Jan 31 10:03:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.40.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.202.241
description:
Jan 31 10:02:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.202.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
description:
Jan 31 10:02:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 31 10:03:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.156.80.230
description:
2025-01-31 10:03:41 dovecot_login authenticator failed for ([117.156.80.230]) [117.156.80.230]:40488: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 10:04:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-31 10:04:32 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:36373: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.156.80.230
description:
Jan 31 10:03:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.156.80.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-31 10:03:39 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:57605: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 31 10:03:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-31 10:03:58 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (lereh) [2.139.88.148]:33486: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


