# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 03:56:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-30 03:55:41 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:32873: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 30 03:55:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.41.12.111
description:
[2025-01-30 03:56:05 +0100] info [webmaild] 38.41.12.111 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.107.67
description:
2025-01-30 03:56:06 dovecot_plain authenticator failed for v2202409233646285895.ultrasrv.de (traxicant) [152.53.107.67]:51524: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.76
description:
47.128.22.76 - - [30/Jan/2025:03:56:10 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15713802 HTTP/2.0" 302 0 worldwide-university.com "https://worldwide-university.com/?__im-XeKUIOhj=1100999064289097213&ap_p=25657&ap_page=shortlink" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.76


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-56.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-30 03:55:57 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:41530: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.107.67
description:
Jan 30 03:56:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 03:56:29 ait sshd[665198]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 30 03:55:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 30 03:57:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-30 03:57:07 dovecot_plain authenticator failed for (prial) [94.140.210.134]:46992: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.31
description:
47.128.98.31 - - [30/Jan/2025:03:57:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14409793 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/9c8e15?panel=twig" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-30 03:57:17 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:54368: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.171.159
description:
Jan 30 03:57:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.171.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.171.159
description:
2025-01-30 03:57:28 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:47634: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.200.17.216
description:
[2025-01-30 03:56:59 +0100] info [webmaild] 81.200.17.216 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Jan 30 03:57:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 30 03:58:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.120.97
description:
2025-01-30 03:57:53 dovecot_plain authenticator failed for v2202501250131308547.bestsrv.de [152.53.120.97]:58408: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
description:
Jan 30 03:58:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Jan 30 03:58:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 30 03:58:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-30 03:58:34 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:49900: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.137.232
description:
[2025-01-30 03:57:52 +0100] info [webmaild] 45.238.137.232 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 30 03:58:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-01-30 03:58:18 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:41224: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-01-30 03:58:29 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:38543: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-30 03:58:34 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:59036: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 03:57:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-30 03:58:03 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:40092: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
description:
2025-01-30 03:58:10 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:49352: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Jan 30 03:58:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.120.97
description:
Jan 30 03:57:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.120.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.88.169.233
description:
Jan 30 03:58:49 ait sshd[665869]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.88.169.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 30 03:59:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Jan 30 03:59:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-30 03:59:38 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:3077: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
description:
2025-01-30 03:58:44 dovecot_login authenticator failed for ([61.184.36.58]) [61.184.36.53]:37561: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
description:
Jan 30 03:58:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.126
description:
Jan 30 03:59:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.205.11
description:
[2025-01-30 03:59:14 +0100] info [webmaild] 181.78.205.11 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.239.241.78
description:
2025-01-30 03:59:23 dovecot_plain authenticator failed for ([121.239.241.78]) [121.239.241.78]:56393: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-30 03:59:33 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:57611: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.36.53
description:
Jan 30 03:58:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.36.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.88.169.233
description:
Jan 30 03:58:49 ait sshd[665869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.169.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.239.241.78
description:
Jan 30 03:59:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.239.241.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
description:
2025-01-30 03:58:52 dovecot_plain authenticator failed for ([58.18.88.146]) [58.18.88.146]:44801: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.126
description:
2025-01-30 03:59:06 dovecot_login authenticator failed for (nsg-corporate-126.230.187.122.airtel.in) [122.187.230.126]:50569: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-30 03:59:24 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:39341: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 30 03:59:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.190.220
description:
[2025-01-30 04:00:02 +0100] info [webmaild] 119.160.190.220 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.78
description:
Jan 30 04:00:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.78
description:
2025-01-30 04:00:24 dovecot_plain authenticator failed for (unslies) [65.20.162.78]:56278: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Jan 30 04:00:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-30 04:01:03 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (pretaraton) [54.38.80.107]:33598: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-30 04:01:19 dovecot_login authenticator failed for (nsg-static-170.125.76.182-airtel.com) [182.76.87.90]:39914: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-01-30 04:00:42 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:54356: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-01-30 04:01:04 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:39483: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 30 04:01:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-30 04:01:11 dovecot_plain authenticator failed for (brallen) [65.20.143.159]:56116: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.14.87
description:
[2025-01-30 04:00:48 +0100] info [webmaild] 131.0.14.87 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-30 04:01:16 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (tandersh) [81.225.30.107]:55372: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.249.137
description:
[2025-01-30 04:01:39 +0100] info [webmaild] 179.127.249.137 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Jan 30 04:00:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-01-30 04:00:52 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:50064: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 30 04:01:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 30 04:01:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.185.131
description:
Jan 30 04:02:02 ait sshd[667316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.228.185.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.228.185.131
description:
Jan 30 04:02:02 ait sshd[667316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.228.185.131


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.36.93
description:
47.128.36.93 - - [30/Jan/2025:04:02:05 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12347175" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.93


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.40
description:
2025-01-30 04:02:36 dovecot_login authenticator failed for ([104.241.228.40]) [104.241.228.40]:47091: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.40
description:
Jan 30 04:02:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
description:
Jan 30 04:03:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.162
description:
Jan 30 04:03:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-30 04:03:38 dovecot_login authenticator failed for ([14.97.143.225]) [182.71.173.250]:43660: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
description:
2025-01-30 04:03:40 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:56023: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
description:
2025-01-30 04:03:24 dovecot_login authenticator failed for ([182.78.83.78]) [182.78.83.78]:36354: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 04:03:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-30 04:02:55 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:42264: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.162
description:
2025-01-30 04:03:26 dovecot_login authenticator failed for p7001163-ipoefx.ipoe.ocn.ne.jp [118.3.227.162]:46996: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.232.79.246
description:
[2025-01-30 04:03:25 +0100] info [webmaild] 24.232.79.246 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.7
description:
47.128.47.7 - - [30/Jan/2025:04:02:50 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7504626 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?duration=short%2Cmedium&filter_course-language=120&filtering=1&instructor=2&level=intermediate%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.7


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
description:
2025-01-30 04:03:48 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:52614: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 30 04:03:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.228.185.131
description:
Jan 30 04:04:33 ait sshd[668326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.228.185.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-01-30 04:03:58 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:60960: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.32.165
description:
[2025-01-30 04:04:14 +0100] info [webmaild] 191.5.32.165 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 30 04:03:48 ait sshd[668106]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 30 04:03:48 ait sshd[668106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-30 04:03:54 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:45944: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
description:
2025-01-30 04:04:35 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:59352: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-30 04:04:00 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:38706: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Jan 30 04:04:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-01-30 04:04:08 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:13218: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.185.131
description:
Jan 30 04:04:33 ait sshd[668326]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.228.185.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.96.100.99
description:
Jan 30 04:05:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.96.100.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Jan 30 04:04:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.148.193.5
description:
[2025-01-30 04:04:58 +0100] info [webmaild] 186.148.193.5 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.88.169.233
description:
Jan 30 04:05:13 ait sshd[668736]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.88.169.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.88.169.233
description:
Jan 30 04:05:13 ait sshd[668736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.169.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-30 04:05:31 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:58664: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-01-30 04:04:54 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.142.238]:47706: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 04:05:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.96.100.99
description:
2025-01-30 04:05:37 dovecot_login authenticator failed for ppp-171-96-100-99.revip8.asianet.co.th [171.96.100.99]:42917: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-30 04:05:21 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:56944: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Jan 30 04:05:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.185.131
description:
Jan 30 04:06:00 ait sshd[669074]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.228.185.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.228.185.131
description:
Jan 30 04:06:00 ait sshd[669074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.228.185.131


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.228.185.131
description:
Jan 30 04:06:02 ait sshd[669074]: Failed password for invalid user giulia from 125.228.185.131 port 52146 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
description:
2025-01-30 04:06:20 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:43276: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 30 04:06:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.135
description:
47.128.122.135 - - [30/Jan/2025:04:06:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25976365 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?filter_course-language=121&filtering=1&level=expert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.242.27.62
description:
[2025-01-30 04:05:51 +0100] info [webmaild] 190.242.27.62 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.88.169.233
description:
Jan 30 04:06:04 ait sshd[669141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.88.169.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.88.169.233
description:
Jan 30 04:06:04 ait sshd[669141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.169.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.34.26
description:
2025-01-30 04:06:09 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:40870: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.213
description:
Jan 30 04:06:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-01-30 04:07:18 dovecot_login authenticator failed for ([60.247.92.186]) [60.247.92.186]:59390: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.68.39.6
description:
Jan 30 04:06:50 ait sshd[669406]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.68.39.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.2.14
description:
2025-01-30 04:06:45 dovecot_login authenticator failed for cm-staticip-85-152-2-14.telecable.es [85.152.2.14]:54452: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.68.39.6
description:
Jan 30 04:06:50 ait sshd[669406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.68.39.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 30 04:06:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.213
description:
2025-01-30 04:07:01 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:39090: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-01-30 04:07:04 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:49255: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 30 04:07:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-30 04:07:39 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:35954: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-30 04:06:54 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:61384: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Jan 30 04:07:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.176.99.86
description:
[2025-01-30 04:07:21 +0100] info [webmaild] 179.176.99.86 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-30 04:07:30 dovecot_login authenticator failed for ([182.76.125.171]) [182.76.87.90]:52930: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 30 04:08:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
description:
2025-01-30 04:08:39 dovecot_plain authenticator failed for ([46.98.10.109]) [46.98.10.109]:57750: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-30 04:08:13 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (encanst) [91.200.226.218]:48340: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-30 04:08:13 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:44474: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
description:
2025-01-30 04:07:49 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:23840: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-30 04:08:02 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:45260: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 04:08:18 ait sshd[669852]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.118
description:
Jan 30 04:07:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.112.37
description:
[2025-01-30 04:08:09 +0100] info [webmaild] 181.46.112.37 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 04:08:35 ait sshd[670001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-30 04:08:17 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:14820: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.210.176
description:
Jan 30 04:07:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.210.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.216
description:
Jan 30 04:07:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-01-30 04:07:53 dovecot_login authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:50446: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.216
description:
2025-01-30 04:07:57 dovecot_plain authenticator failed for 111-70-39-216.emome-ip.hinet.net [111.70.39.216]:32849: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
description:
Jan 30 04:08:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-30 04:08:07 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:51266: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 04:08:35 ait sshd[670001]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
description:
2025-01-30 04:08:05 dovecot_login authenticator failed for ([178.178.194.136]) [178.178.194.136]:33968: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 04:08:18 ait sshd[669852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.210.176
description:
2025-01-30 04:07:49 dovecot_login authenticator failed for ([183.107.210.176]) [183.107.210.176]:33262: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-30 04:08:55 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:39758: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 30 04:09:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-30 04:09:31 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:43482: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 04:09:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Jan 30 04:08:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
description:
2025-01-30 04:08:56 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:49253: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.113.44.6
description:
[2025-01-30 04:09:04 +0100] info [webmaild] 189.113.44.6 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
description:
2025-01-30 04:09:07 dovecot_login authenticator failed for (user-static-94-254-244-211.mobile.play-internet.pl) [94.254.244.211]:32929: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 04:09:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-09.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
description:
Jan 30 04:09:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-01-30 04:10:32 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:53248: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
description:
2025-01-30 04:09:46 dovecot_login authenticator failed for ([127.0.0.1]) [222.114.84.175]:41236: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.248
description:
47.128.119.248 - - [30/Jan/2025:04:09:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21086289 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?filter_course-language=118%2C99&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.234.16
description:
Jan 30 04:09:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.234.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-30 04:09:45 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:43199: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 04:09:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.156.38.192
description:
[2025-01-30 04:09:56 +0100] info [webmaild] 102.156.38.192 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 04:10:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.221.234.16
description:
2025-01-30 04:09:58 dovecot_login authenticator failed for ([127.0.0.1]) [117.221.234.16]:49808: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 04:10:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 04:10:31 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (cortiths) [51.255.84.180]:52442: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.99.71
description:
[2025-01-30 04:11:35 +0100] info [webmaild] 45.224.99.71 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-30 04:10:41 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:51851: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 04:12:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.30.48.62
description:
[2025-01-30 04:12:24 +0100] info [webmaild] 191.30.48.62 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.169.41.188
description:
Jan 30 04:12:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.169.41.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 04:12:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.41.188
description:
2025-01-30 04:12:27 dovecot_login authenticator failed for ([127.0.0.1]) [113.169.41.188]:49471: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 04:12:34 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:36424: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
description:
2025-01-30 04:12:57 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:53639: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-01-30 04:13:20 dovecot_plain authenticator failed for ([31.173.9.222]) [31.173.9.222]:46616: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.113.162
description:
[2025-01-30 04:13:03 +0100] info [webmaild] 157.100.113.162 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-30 04:13:16 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:59410: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.164.28
description:
Jan 30 04:13:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.164.28
description:
2025-01-30 04:13:35 dovecot_plain authenticator failed for (abts-north-static-028.164.160.122.airtelbroadband.in) [122.160.164.28]:54150: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 30 04:12:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-30 04:14:04 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:49394: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 30 04:14:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.106.154.237
description:
2025-01-30 04:14:22 dovecot_login authenticator failed for ([149.106.154.237]) [149.106.154.237]:42548: 535 Incorrect authentication data (set_id=ads21b00177y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
description:
Jan 30 04:14:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
description:
2025-01-30 04:14:24 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:45294: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-30 04:13:52 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:44203: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.178.221.193
description:
[2025-01-30 04:13:55 +0100] info [webmaild] 160.178.221.193 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-01-30 04:14:36 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:64272: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.137.108
description:
2025-01-30 04:14:43 dovecot_login authenticator failed for ([117.192.137.108]) [117.192.137.108]:36778: 535 Incorrect authentication data (set_id=ads21b00177y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.182.27
description:
Jan 30 04:14:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.182.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.196
description:
2025-01-30 04:15:31 dovecot_plain authenticator failed for ([76.77.25.196]) [76.77.25.196]:60683: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.250.90.230
description:
[2025-01-30 04:15:32 +0100] info [webmaild] 41.250.90.230 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.68.39.6
description:
Jan 30 04:15:38 ait sshd[672363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.68.39.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.68.39.6
description:
Jan 30 04:15:38 ait sshd[672363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.68.39.6


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.182.27
description:
2025-01-30 04:14:54 dovecot_login authenticator failed for ([127.0.0.1]) [5.30.182.27]:46527: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.62.3
description:
2025-01-30 04:15:13 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:44430: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
description:
Jan 30 04:15:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Jan 30 04:15:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-01-30 04:15:25 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:60473: 535 Incorrect authentication data (set_id=ads22a00122y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.214.84
description:
Jan 30 04:14:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.214.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.62.3
description:
Jan 30 04:15:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.62.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
description:
2025-01-30 04:15:19 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:51116: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.196
description:
Jan 30 04:15:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.214.84
description:
2025-01-30 04:15:01 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.214.84]:39751: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-30 04:15:26 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:42284: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.68.39.6
description:
Jan 30 04:15:40 ait sshd[672363]: Failed password for invalid user shane from 154.68.39.6 port 45030 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
description:
2025-01-30 04:15:40 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:35714: 535 Incorrect authentication data (set_id=ads22a00122y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.17.160
description:
[2025-01-30 04:16:20 +0100] info [webmaild] 45.176.17.160 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-30 04:16:29 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:45228: 535 Incorrect authentication data (set_id=eng20a00040y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 30 04:16:37 ait sshd[672791]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 04:16:37 ait sshd[672791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 30 04:16:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 04:16:16 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4239: 535 Incorrect authentication data (set_id=eng20a00040y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 30 04:16:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
description:
Jan 30 04:16:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.91.254
description:
[2025-01-30 04:17:02 +0100] info [webmaild] 191.7.91.254 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-01-30 04:17:07 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:39173: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.41.69.130
description:
2025-01-30 04:17:22 dovecot_login authenticator failed for syn-047-041-069-130.res.spectrum.com [47.41.69.130]:45375: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.212.174
description:
Jan 30 04:17:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.212.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.212.174
description:
2025-01-30 04:17:38 dovecot_login authenticator failed for ([103.142.212.174]) [103.142.212.174]:35799: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-01-30 04:16:56 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:36600: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.138.130.17
description:
2025-01-30 04:17:56 dovecot_plain authenticator failed for p578a8211.dip0.t-ipconnect.de (strase) [87.138.130.17]:39710: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 30 04:17:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-01-30 04:18:23 dovecot_login authenticator failed for ([127.0.0.1]) [27.223.100.90]:57432: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 125.212.214.104
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:04-18.125.212.214.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.59.43
description:
[2025-01-30 04:17:55 +0100] info [webmaild] 181.199.59.43 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.57.70.22
description:
Jan 30 04:18:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.57.70.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.57.70.22
description:
2025-01-30 04:18:13 dovecot_login authenticator failed for (host-216-57-70-22-cal.net) [216.57.70.22]:44560: 535 Incorrect authentication data (set_id=ads16a00084y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:mur73269phy||WPU:mur73269phy||RSV:6.65||T:APACHE||MV:04-18.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 04:17:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.227.209.106
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:04-18.165.227.209.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.138.130.17
description:
Jan 30 04:17:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.138.130.17 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 136.244.100.254
domain: elibrary.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:04-18.136.244.100.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Jan 30 04:18:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
description:
Jan 30 04:18:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
description:
2025-01-30 04:18:32 dovecot_login authenticator failed for ([127.0.0.1]) [123.182.89.19]:59057: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.68.39.6
description:
Jan 30 04:20:39 ait sshd[674143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.68.39.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.68.39.6
description:
Jan 30 04:20:39 ait sshd[674143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.68.39.6


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 04:19:59 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:54599: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.252.188.130
description:
Jan 30 04:20:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.252.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.10.28.206
description:
[2025-01-30 04:20:09 +0100] info [webmaild] 103.10.28.206 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.252.188.130
description:
2025-01-30 04:20:11 dovecot_login authenticator failed for mail.bajajhealth.com (undefined.hostname.localhost) [123.252.188.130]:51290: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
description:
2025-01-30 04:20:40 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:56018: 535 Incorrect authentication data (set_id=abs19a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-30 04:21:10 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:45664: 535 Incorrect authentication data (set_id=ads20b00330y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.153.114.124
description:
2025-01-30 04:21:21 dovecot_login authenticator failed for ([127.0.0.1]) [218.153.114.124]:2641: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
description:
Jan 30 04:21:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
description:
2025-01-30 04:20:54 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:33582: 535 Incorrect authentication data (set_id=ads20b00330y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
description:
2025-01-30 04:21:23 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:46958: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.190.150.4
description:
Jan 30 04:20:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.190.150.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.117.48.106
description:
[2025-01-30 04:20:55 +0100] info [webmaild] 87.117.48.106 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-30 04:21:10 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:46930: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
description:
2025-01-30 04:21:10 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:54956: 535 Incorrect authentication data (set_id=onajah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-01-30 04:21:22 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.250.139]:64124: 535 Incorrect authentication data (set_id=onajah)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.68.39.6
description:
Jan 30 04:20:41 ait sshd[674143]: Failed password for invalid user qadmin from 154.68.39.6 port 39664 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.153.114.124
description:
Jan 30 04:21:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.153.114.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-30 04:20:51 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:52257: 535 Incorrect authentication data (set_id=abs19a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.250.139
description:
Jan 30 04:21:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.0.107.78
description:
Jan 30 04:21:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.0.107.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 04:20:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.0.107.78
description:
2025-01-30 04:21:27 dovecot_login authenticator failed for cpc81914-leic18-2-0-cust77.8-1.cable.virginm.net ([127.0.0.1]) [82.0.107.78]:38218: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 04:21:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.92.93.155
description:
[2025-01-30 04:21:49 +0100] info [webmaild] 201.92.93.155 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 04:22:08 ait sshd[674744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 04:22:08 ait sshd[674744]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 04:23:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 04:22:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-22.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.62.46.107
description:
[2025-01-30 04:23:12 +0100] info [webmaild] 189.62.46.107 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.56.141.212
description:
Jan 30 04:23:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.56.141.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-30 04:24:05 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:48065: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.144.82.250
description:
2025-01-30 04:24:39 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:51346: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.107.188.140
description:
[2025-01-30 04:24:15 +0100] info [webmaild] 177.107.188.140 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 04:23:47 ait sshd[675407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 30 04:24:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 30 04:23:47 ait sshd[675407]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.56.141.212
description:
2025-01-30 04:23:56 dovecot_login authenticator failed for ([127.0.0.1]) [27.56.141.212]:47431: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-30 04:23:56 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:34473: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.144.82.250
description:
Jan 30 04:24:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.144.82.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-30 04:23:44 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:48418: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 211.149.239.234
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:04-23.211.149.239.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.213.252.93
description:
2025-01-30 04:24:52 dovecot_login authenticator failed for ([127.0.0.1]) [117.213.252.93]:45239: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
description:
2025-01-30 04:25:02 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:42508: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.161.163.175
description:
2025-01-30 04:25:02 dovecot_login authenticator failed for ([127.0.0.1]) [113.161.163.175]:53578: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.77.126
description:
[2025-01-30 04:24:43 +0100] info [webmaild] 45.170.77.126 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 30 04:24:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 04:24:48 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4509: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.252.93
description:
Jan 30 04:24:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.252.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.234.84.243
description:
[2025-01-30 04:25:34 +0100] info [webmaild] 88.234.84.243 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 30 04:24:51 ait sshd[675700]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
description:
Jan 30 04:24:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.163.175
description:
Jan 30 04:25:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.161.163.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
description:
2025-01-30 04:25:38 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:57500: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
description:
2025-01-30 04:24:58 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:52850: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
description:
Jan 30 04:25:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.210
description:
2025-01-30 04:25:27 dovecot_plain authenticator failed for ([61.169.54.210]) [61.169.54.210]:48661: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 04:26:12 ait sshd[676363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 04:26:12 ait sshd[676363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.21.214.82
description:
2025-01-30 04:27:24 dovecot_login authenticator failed for (82.214.21.175.adsl-pool.jlccptt.net.cn) [175.21.214.82]:43914: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.143.77.111
description:
Jan 30 04:27:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.143.77.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-30 04:27:26 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:39990: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
description:
2025-01-30 04:27:34 dovecot_login authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:45343: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-30 04:26:50 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:52988: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 30 04:27:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-30 04:27:03 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:16294: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.143.77.111
description:
2025-01-30 04:27:13 dovecot_login authenticator failed for ([220.189.239.206]) [183.143.77.111]:59754: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.65.249
description:
[2025-01-30 04:27:20 +0100] info [webmaild] 157.100.65.249 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.21.214.82
description:
Jan 30 04:27:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.21.214.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.162.252
description:
[2025-01-30 04:28:08 +0100] info [webmaild] 168.232.162.252 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 30 04:27:41 ait sshd[676694]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 30 04:27:41 ait sshd[676694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.199.245
description:
[2025-01-30 04:28:31 +0100] info [webmaild] 45.176.199.245 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.130.158.98
description:
2025-01-30 04:29:39 dovecot_plain authenticator failed for ([185.130.158.98]) [185.130.158.98]:47440: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 30 04:28:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 04:28:51 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4769: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-01-30 04:29:06 dovecot_login authenticator failed for ([187.19.47.79]) [187.19.47.79]:45910: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.78.224.106
description:
[2025-01-30 04:29:25 +0100] info [webmaild] 186.78.224.106 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.130.158.98
description:
Jan 30 04:29:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.130.158.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.117.118
description:
2025-01-30 04:29:37 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:42605: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-30 04:30:30 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:27239: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-01-30 04:29:46 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:45886: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-01-30 04:29:49 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:56438: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-30.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 04:30:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 30 04:30:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Jan 30 04:31:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 04:31:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:04-30.147.135.223.135


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:04-30.103.249.112.157


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-30 04:30:45 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:46642: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
description:
Jan 30 04:31:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
description:
2025-01-30 04:31:12 dovecot_login authenticator failed for ([61.184.36.58]) [61.184.36.53]:54224: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.221.234.16
description:
2025-01-30 04:31:13 dovecot_login authenticator failed for ([127.0.0.1]) [117.221.234.16]:44810: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.71.6.31
description:
Jan 30 04:31:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.71.6.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.6.31
description:
2025-01-30 04:31:19 dovecot_login authenticator failed for ([127.0.0.1]) [178.71.6.31]:45018: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-01-30 04:31:03 dovecot_login authenticator failed for ([87.103.210.232]) [87.103.210.232]:42192: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
description:
2025-01-30 04:31:25 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:46462: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.84.253
description:
[2025-01-30 04:31:32 +0100] info [webmaild] 84.54.84.253 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.236
description:
2025-01-30 04:30:54 dovecot_login authenticator failed for (nsg-corporate-236.227.187.122.airtel.in) [122.187.227.236]:54893: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.234.16
description:
Jan 30 04:31:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.234.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.106.40.172
description:
[2025-01-30 04:32:21 +0100] info [webmaild] 187.106.40.172 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.126.131.136
description:
[2025-01-30 04:32:31 +0100] info [webmaild] 179.126.131.136 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 04:33:32 ait sshd[678881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.163
description:
47.128.22.163 - - [30/Jan/2025:04:32:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=30737919 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/54e343?panel=exception" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.43.181
description:
[2025-01-30 04:33:23 +0100] info [webmaild] 177.185.43.181 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.109.217.15
description:
Jan 30 04:33:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.109.217.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 04:33:32 ait sshd[678881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-01-30 04:33:44 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:50561: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 30 04:34:05 ait sshd[679088]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-30 04:33:56 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:58386: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.193.253.248
description:
Jan 30 04:34:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.193.253.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
description:
Jan 30 04:33:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.193.253.248
description:
2025-01-30 04:34:02 dovecot_login authenticator failed for ipbcc1fdf8.dynamic.kabel-deutschland.de ([127.0.0.1]) [188.193.253.248]:39894: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-01-30 04:33:56 dovecot_login authenticator failed for wsip-64-207-225-55.tu.ok.cox.net ([127.0.0.1]) [64.207.225.55]:44903: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 04:34:05 ait sshd[679088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-01-30 04:35:20 dovecot_login authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([127.0.0.1]) [61.216.7.163]:37663: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.122.40
description:
Jan 30 04:35:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.122.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-30 04:34:57 dovecot_plain authenticator failed for (undefined.hostname.localhost) [182.76.87.90]:55186: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.192
description:
2025-01-30 04:35:11 dovecot_plain authenticator failed for ([37.142.173.192]) [37.142.173.192]:51653: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-01-30 04:35:27 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:51271: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 04:35:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.213.164.27
description:
2025-01-30 04:34:45 dovecot_plain authenticator failed for ([1.213.164.27]) [1.213.164.27]:52576: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-01-30 04:35:15 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:50424: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Jan 30 04:35:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.122.40
description:
2025-01-30 04:35:26 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.122.40]:55795: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.213.164.27
description:
Jan 30 04:34:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.213.164.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Jan 30 04:35:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 30 04:35:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-30 04:35:39 dovecot_plain authenticator failed for (wouts) [185.65.238.250]:48076: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.174.209.160
description:
2025-01-30 04:35:01 dovecot_plain authenticator failed for ([220.174.209.156]) [220.174.209.160]:38479: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 30 04:35:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-30 04:36:00 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (nonogona) [89.153.62.100]:58752: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 30 04:36:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.222
description:
[2025-01-30 04:36:36 +0100] info [webmaild] 213.230.87.222 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-30 04:36:36 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:56642: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.162.13
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS23B00195Y||WPU:ADS23B00195Y||RSV:6.65||T:APACHE||MV:04-36.45.61.162.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.174.93
description:
[2025-01-30 04:35:49 +0100] info [webmaild] 177.22.174.93 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-36.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.101.10
description:
[2025-01-30 04:36:26 +0100] info [webmaild] 168.205.101.10 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
description:
Jan 30 04:36:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-01-30 04:37:06 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:50754: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.163
description:
Jan 30 04:36:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.163 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.162.13
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ABS23B00054Y||WPU:ABS23B00054Y||RSV:6.65||T:APACHE||MV:04-36.45.61.162.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
description:
2025-01-30 04:36:55 dovecot_login authenticator failed for ([221.0.111.113]) [221.0.111.113]:53225: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
description:
Jan 30 04:37:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 04:37:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.163
description:
2025-01-30 04:36:46 dovecot_plain authenticator failed for ([103.146.233.163]) [103.146.233.163]:54486: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
description:
Jan 30 04:36:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
description:
2025-01-30 04:37:06 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (gononize) [80.14.31.158]:37878: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
description:
Jan 30 04:37:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 30 04:37:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.159.66
description:
[2025-01-30 04:37:16 +0100] info [webmaild] 170.239.159.66 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.185
description:
Jan 30 04:36:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
description:
2025-01-30 04:36:59 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:41529: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 30 04:38:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.85.42.195
description:
Jan 30 04:37:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.85.42.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.85.42.195
description:
2025-01-30 04:37:53 dovecot_plain authenticator failed for ([1.85.42.195]) [1.85.42.195]:52894: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.170.160
description:
Jan 30 04:38:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 04:38:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-30 04:38:19 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:47584: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-30 04:38:32 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:51174: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.21.254.67
description:
2025-01-30 04:37:44 dovecot_login authenticator failed for ([127.0.0.1]) [37.21.254.67]:51591: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 30 04:38:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 30 04:38:29 ait sshd[680450]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 04:38:29 ait sshd[680450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.21.254.67
description:
Jan 30 04:37:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.21.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 30 04:37:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-30 04:38:00 dovecot_login authenticator failed for ([127.0.0.1]) [203.34.57.78]:51082: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
description:
Jan 30 04:38:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
description:
2025-01-30 04:38:10 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:55723: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.170.160
description:
2025-01-30 04:38:08 dovecot_login authenticator failed for ([127.0.0.1]) [103.89.170.160]:35788: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-01-30 04:39:19 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:27708: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 04:38:55 ait sshd[680533]: Invalid user mijnepdmglasbalustrade.com 2a02 from 122.51.104.242 port 55946


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 04:38:55 ait sshd[680533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-30 04:38:57 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:48414: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 04:39:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Jan 30 04:39:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.148
description:
2025-01-30 04:39:33 dovecot_plain authenticator failed for ([120.198.138.148]) [120.198.138.148]:45251: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
description:
2025-01-30 04:39:02 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:49798: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 30 04:39:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 30 04:39:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-30 04:39:17 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:27861: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-01-30 04:39:28 dovecot_plain authenticator failed for ([39.174.90.43]) [39.174.90.43]:43331: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 04:38:55 ait sshd[680533]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.127.158
description:
47.128.127.158 - - [30/Jan/2025:04:39:15 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23643433 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205&filter_course-language=120%2C79%2C121%2C183%2C118&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.127.158


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.148
description:
Jan 30 04:39:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 30 04:38:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.86.7.65
description:
Jan 30 04:39:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.86.7.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-01-30 04:39:14 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:37161: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
description:
Jan 30 04:39:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 04:39:44 ait sshd[680754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.87.204
description:
Jan 30 04:40:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.87.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.152.174.247
description:
[2025-01-30 04:40:32 +0100] info [webmaild] 179.152.174.247 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 04:39:44 ait sshd[680754]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.204
description:
2025-01-30 04:40:15 dovecot_plain authenticator failed for ([220.179.87.204]) [220.179.87.204]:56369: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-01-30 04:40:28 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:18636: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.50.95.176
description:
[2025-01-30 04:39:55 +0100] info [webmaild] 189.50.95.176 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.90.129.81
description:
[2025-01-30 04:40:17 +0100] info [whostmgrd] 164.90.129.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
description:
Jan 30 04:40:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.255.88.165
description:
[2025-01-30 04:40:44 +0100] info [webmaild] 179.255.88.165 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 30 04:40:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.241.15
description:
Jan 30 04:40:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.241.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.95.121.9
description:
[2025-01-30 04:41:25 +0100] info [webmaild] 197.95.121.9 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-30 04:40:57 dovecot_login authenticator failed for ([186.247.238.25]) [200.149.51.186]:35557: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
description:
2025-01-30 04:40:47 dovecot_login authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:53904: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Jan 30 04:42:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
description:
Jan 30 04:42:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
description:
2025-01-30 04:42:20 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:40159: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-30 04:42:20 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:29441: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 30 04:42:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.117.186
description:
Jan 30 04:41:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.117.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 30 04:42:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 30 04:42:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-30 04:42:25 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:45907: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-01-30 04:42:10 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:43246: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.117.186
description:
2025-01-30 04:41:54 dovecot_login authenticator failed for ([60.219.117.186]) [60.219.117.186]:52074: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-30 04:42:07 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:45362: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 04:42:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
description:
2025-01-30 04:42:54 dovecot_login authenticator failed for ([58.63.214.213]) [58.63.214.213]:29315: 535 Incorrect authentication data (set_id=jaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.209.48
description:
Jan 30 04:43:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.209.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
description:
2025-01-30 04:43:25 dovecot_plain authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:60408: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
description:
Jan 30 04:42:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.63.214.213
description:
Jan 30 04:42:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.63.214.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Jan 30 04:43:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-01-30 04:43:36 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:42548: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
description:
2025-01-30 04:42:45 dovecot_login authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:42835: 535 Incorrect authentication data (set_id=jaster@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Jan 30 04:44:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-01-30 04:44:32 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:60252: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.172.40.187
description:
[2025-01-30 04:43:42 +0100] info [webmaild] 177.172.40.187 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.217.80.77
description:
[2025-01-30 04:44:14 +0100] info [webmaild] 181.217.80.77 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.50.138.254
description:
[2025-01-30 04:44:29 +0100] info [webmaild] 179.50.138.254 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.33.207.58
description:
Jan 30 04:44:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.33.207.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-30 04:45:22 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:57960: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.106.250
description:
[2025-01-30 04:45:06 +0100] info [webmaild] 45.236.106.250 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.8.218.54
description:
Jan 30 04:44:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.8.218.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.33.207.58
description:
2025-01-30 04:44:44 dovecot_plain authenticator failed for ([121.33.207.58]) [121.33.207.58]:57540: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-01-30 04:45:04 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:34327: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 30 04:45:04 ait sshd[682695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.94.174.231
description:
2025-01-30 04:45:34 dovecot_plain authenticator failed for ([109.94.174.231]) [109.94.174.231]:39922: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
description:
2025-01-30 04:44:47 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:59377: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 30 04:45:04 ait sshd[682695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 30 04:45:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.94.174.231
description:
Jan 30 04:45:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.94.174.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 04:46:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.164.137
description:
Jan 30 04:47:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.164.137 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 04:47:38 ait sshd[683589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.240
description:
Jan 30 04:46:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.240
description:
2025-01-30 04:46:59 dovecot_plain authenticator failed for 111-70-21-240.emome-ip.hinet.net [111.70.21.240]:38025: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 04:47:38 ait sshd[683589]: Invalid user mijnepdmglasbalustrade.com 2a02 from 122.51.104.242 port 40108


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 04:47:38 ait sshd[683589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
description:
2025-01-30 04:47:39 dovecot_plain authenticator failed for (setras) [65.20.164.137]:33701: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 30 04:47:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-30 04:47:08 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:53100: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.121.40
description:
[2025-01-30 04:47:34 +0100] info [webmaild] 128.201.121.40 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Jan 30 04:47:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.211.143.35
description:
[2025-01-30 04:48:04 +0100] info [webmaild] 41.211.143.35 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 04:48:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 04:47:40 ait sshd[683589]: Failed password for invalid user mijnepdmglasbalustrade.com 2a02 from 122.51.104.242 port 40108 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
description:
Jan 30 04:47:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.148.207
description:
[2025-01-30 04:48:22 +0100] info [webmaild] 45.190.148.207 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.151.72.211
description:
Jan 30 04:48:34 ait sshd[683793]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.151.72.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.151.72.211
description:
Jan 30 04:48:34 ait sshd[683793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.151.72.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
description:
2025-01-30 04:47:46 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:38002: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-01-30 04:48:00 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:10817: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 113.199.230.211
description:
[2025-01-30 04:48:58 +0100] info [webmaild] 113.199.230.211 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-49.15.206.171.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
description:
Jan 30 04:49:26 ait sshd[684020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.203
description:
Jan 30 04:49:26 ait sshd[684020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 30 04:49:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 04:50:24 ait sshd[684755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
description:
Jan 30 04:49:40 ait sshd[684020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.236.167.57
description:
Jan 30 04:50:15 ait sshd[684643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.167.57


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 04:50:24 ait sshd[684755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 04:50:48 ait sshd[684797]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 04:50:48 ait sshd[684797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.48.78.29
description:
Jan 30 04:50:59 ait sshd[684801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 201.48.78.29 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.48.78.29
description:
Jan 30 04:50:59 ait sshd[684801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.48.78.29


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.38.174
description:
[2025-01-30 04:51:22 +0100] info [webmaild] 143.137.38.174 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.193.147
description:
Jan 30 04:51:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.193.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.151.72.211
description:
Jan 30 04:51:56 ait sshd[685150]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.151.72.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 30 04:52:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.176
description:
2025-01-30 04:51:44 dovecot_plain authenticator failed for (nsg-corporate-176.229.187.122.airtel.in) [122.187.229.176]:44947: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-01-30 04:52:07 dovecot_plain authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:37550: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.157.126
description:
2025-01-30 04:52:16 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:57345: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-30 04:52:40 dovecot_plain authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:46567: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.176
description:
Jan 30 04:51:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.225.81.216
description:
[2025-01-30 04:51:50 +0100] info [webmaild] 181.225.81.216 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.209.193.147
description:
2025-01-30 04:51:55 dovecot_plain authenticator failed for ([186.209.193.147]) [186.209.193.147]:48830: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.151.72.211
description:
Jan 30 04:51:56 ait sshd[685150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.151.72.211


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.34.210
description:
[2025-01-30 04:52:10 +0100] info [webmaild] 45.180.34.210 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.157.126
description:
Jan 30 04:52:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.157.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
description:
Jan 30 04:52:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.64.68.99
description:
Jan 30 04:52:20 ait sshd[685317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.64.68.99  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.28.125.96
description:
Jan 30 04:53:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.28.125.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 30 04:53:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-01-30 04:53:22 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:43888: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 30 04:52:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-30 04:52:51 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:34631: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 30 04:52:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-30 04:52:58 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34436: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.58
description:
Jan 30 04:53:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Jan 30 04:53:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-30 04:53:35 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:1933: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.167.30
description:
[2025-01-30 04:52:47 +0100] info [webmaild] 197.185.167.30 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 04:52:58 ait sshd[685429]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.28.125.96
description:
2025-01-30 04:53:15 dovecot_plain authenticator failed for ([38.28.125.96]) [38.28.125.96]:53765: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Jan 30 04:53:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.58
description:
2025-01-30 04:53:28 dovecot_plain authenticator failed for ([91.227.31.58]) [91.227.31.58]:33524: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 30 04:53:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-01-30 04:53:34 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:60380: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-30 04:52:50 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:59828: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 04:52:58 ait sshd[685429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-30 04:53:24 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:56983: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 30 04:52:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.151.72.211
description:
Jan 30 04:55:30 ait sshd[686263]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.151.72.211 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.151.72.211
description:
Jan 30 04:55:31 ait sshd[686263]: Failed password for invalid user office from 115.151.72.211 port 54470 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.1.15
description:
[2025-01-30 04:55:37 +0100] info [webmaild] 170.81.1.15 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.68.99
description:
Jan 30 04:54:46 ait sshd[685879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.64.68.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.40.107.212
description:
[2025-01-30 04:55:15 +0100] info [webmaild] 187.40.107.212 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.48.78.29
description:
Jan 30 04:55:06 ait sshd[686035]: pam_imunify(sshd:auth): [IM360_RBL] The IP 201.48.78.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 04:54:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.64.68.99
description:
Jan 30 04:54:46 ait sshd[685879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.64.68.99


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.48.78.29
description:
Jan 30 04:55:06 ait sshd[686035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.48.78.29


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.151.72.211
description:
Jan 30 04:55:30 ait sshd[686263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.151.72.211


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 04:54:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 30 04:55:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-30 04:55:54 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:30118: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
description:
2025-01-30 04:55:56 dovecot_login authenticator failed for 31-208-136-225.cust.bredband2.com ([127.0.0.1]) [31.208.136.225]:52750: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.68.99
description:
Jan 30 04:56:20 ait sshd[686533]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.64.68.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.64.68.99
description:
Jan 30 04:56:20 ait sshd[686533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.64.68.99


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.166.193.1
description:
[2025-01-30 04:56:34 +0100] info [webmaild] 103.166.193.1 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.32.104
description:
Jan 30 04:55:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.32.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.138.15.194
description:
2025-01-30 04:55:49 dovecot_login authenticator failed for ([127.0.0.1]) [164.138.15.194]:38854: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
description:
Jan 30 04:55:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.146.186
description:
[2025-01-30 04:56:03 +0100] info [webmaild] 170.80.146.186 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
description:
2025-01-30 04:55:44 dovecot_plain authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:52724: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.138.15.194
description:
Jan 30 04:55:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.138.15.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
description:
2025-01-30 04:56:43 dovecot_plain authenticator failed for ([125.69.76.148]) [125.69.76.148]:38126: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
description:
Jan 30 04:56:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
description:
2025-01-30 04:56:52 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:57752: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
description:
Jan 30 04:56:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.48.78.29
description:
Jan 30 04:56:40 ait sshd[686581]: pam_imunify(sshd:auth): [IM360_RBL] The IP 201.48.78.29 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.48.78.29
description:
Jan 30 04:56:40 ait sshd[686581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.48.78.29  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 04:58:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.93
description:
47.128.36.93 - - [30/Jan/2025:04:58:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4574999 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30&filter_course-language=183%2C99%2C79&filtering=1&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.93


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.79.182.245
description:
Jan 30 04:58:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.79.182.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 30 04:58:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-30 04:58:56 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:42120: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Jan 30 04:59:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Jan 30 04:58:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Jan 30 04:59:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-01-30 04:59:26 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:37909: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.166.2
description:
Jan 30 04:59:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-30 04:59:40 dovecot_plain authenticator failed for (predbred) [65.20.183.209]:52540: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.107.230.182
description:
[2025-01-30 04:59:26 +0100] info [webmaild] 5.107.230.182 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 30 04:59:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-30 04:58:42 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br (186-247-196-225.user.veloxzone.com.br) [186.247.196.106]:47213: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.79.182.245
description:
Jan 30 04:58:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.79.182.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.159.74
description:
Jan 30 04:59:05 ait sshd[687255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.159.74


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.82.36.72
description:
[2025-01-30 04:59:09 +0100] info [webmaild] 181.82.36.72 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.43
description:
47.128.98.43 - - [30/Jan/2025:04:59:39 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21056506 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning?page_id=buy-viagra-online-from-ireland" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 30 04:58:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.159.74
description:
Jan 30 04:59:05 ait sshd[687255]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.159.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.166.2
description:
2025-01-30 04:59:39 dovecot_plain authenticator failed for ([183.237.166.2]) [183.237.166.2]:51625: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-01-30 04:59:40 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:53590: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.232.217.58
description:
[2025-01-30 04:59:56 +0100] info [webmaild] 179.232.217.58 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.222.173.150
description:
[2025-01-30 05:00:18 +0100] info [webmaild] 102.222.173.150 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Jan 30 04:59:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-01-30 04:59:47 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:42634: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.249
description:
47.128.123.249 - - [30/Jan/2025:05:01:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10809067 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C106%2C205&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:01:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:02:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Jan 30 05:01:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.220.155
description:
2025-01-30 05:02:12 dovecot_login authenticator failed for ([127.0.0.1]) [5.142.220.155]:46699: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.81.2
description:
2025-01-30 05:01:45 dovecot_plain authenticator failed for ([65.76.81.2]) [65.76.81.2]:51574: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.108.174
description:
2025-01-30 05:02:06 dovecot_login authenticator failed for ([127.0.0.1]) [117.252.108.174]:44712: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-02.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.81.2
description:
Jan 30 05:01:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.81.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-01-30 05:02:01 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:53898: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.143
description:
2025-01-30 05:03:28 dovecot_plain authenticator failed for ([122.187.227.143]) [122.187.227.143]:41212: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 30 05:03:11 ait sshd[688909]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 30 05:03:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.167.59
description:
Jan 30 05:03:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.167.59 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 05:03:11 ait sshd[688909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-30 05:03:21 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:22099: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.208.107.111
description:
[2025-01-30 05:03:05 +0100] info [webmaild] 181.208.107.111 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Jan 30 05:03:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
description:
2025-01-30 05:03:09 dovecot_plain authenticator failed for ([111.39.167.59]) [111.39.167.59]:53885: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-01-30 05:03:11 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:46185: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.106.41.47
description:
[2025-01-30 05:03:22 +0100] info [webmaild] 187.106.41.47 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.143
description:
Jan 30 05:03:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.143 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 05:03:49 ait sshd[689158]: Invalid user mijnepdmglasbalustrade.com 2a02 from 122.51.104.242 port 44634


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.189.85.34
description:
[2025-01-30 05:03:54 +0100] info [webmaild] 186.189.85.34 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.159.74
description:
Jan 30 05:03:56 ait sshd[689168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.159.74


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:04:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 05:03:50 ait sshd[689158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 05:03:50 ait sshd[689158]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.159.74
description:
Jan 30 05:03:56 ait sshd[689168]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.159.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 05:04:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.42.178
description:
[2025-01-30 05:04:15 +0100] info [webmaild] 158.181.42.178 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 30 05:04:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.148
description:
2025-01-30 05:04:40 dovecot_plain authenticator failed for p160149-obmd01.osaka.ocn.ne.jp [61.112.103.148]:46517: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 05:04:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Jan 30 05:04:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-01-30 05:05:01 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:44720: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 30 05:05:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-30 05:05:10 dovecot_plain authenticator failed for (anchis) [109.108.95.66]:60564: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 05:04:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 05:04:42 dovecot_plain authenticator failed for (reddysines) [81.211.77.58]:3350: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-30 05:04:47 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:35629: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-30 05:06:03 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:53194: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-30 05:06:15 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:44116: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.171.226
description:
Jan 30 05:06:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.171.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 30 05:06:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
description:
2025-01-30 05:06:13 dovecot_plain authenticator failed for ([83.239.171.226]) [83.239.171.226]:35017: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:06:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-06.80.76.51.123


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.159.74
description:
Jan 30 05:05:48 ait sshd[689767]: Failed password for invalid user es from 103.146.159.74 port 56598 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 30 05:06:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 30 05:06:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.188.117
description:
Jan 30 05:06:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.188.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.157.148.187
description:
Jan 30 05:06:38 ait sshd[690080]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.157.148.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.159.74
description:
Jan 30 05:05:46 ait sshd[689767]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.159.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.159.74
description:
Jan 30 05:05:46 ait sshd[689767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.159.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-30 05:06:24 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:56439: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.157.148.187
description:
Jan 30 05:06:38 ait sshd[690080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.157.148.187


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
description:
2025-01-30 05:06:55 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:57910: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.134
description:
2025-01-30 05:07:19 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:58976: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.94.250.102
description:
[2025-01-30 05:07:15 +0100] info [webmaild] 80.94.250.102 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.157.148.187
description:
Jan 30 05:06:40 ait sshd[690080]: Failed password for invalid user ubuntu from 45.157.148.187 port 47712 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
description:
2025-01-30 05:06:40 dovecot_plain authenticator failed for ([82.102.188.117]) [82.102.188.117]:39795: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.166
description:
Jan 30 05:06:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.134
description:
Jan 30 05:07:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.115.91
description:
Jan 30 05:06:55 ait sshd[690265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.115.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.21.175
description:
47.128.21.175 - - [30/Jan/2025:05:07:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11775481 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?filter_course-category=30&filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.21.175


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.115.91
description:
Jan 30 05:06:55 ait sshd[690265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.115.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.2.101.99
description:
[2025-01-30 05:07:08 +0100] info [webmaild] 179.2.101.99 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.28.202.179
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:05-07.104.28.202.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.247.90
description:
2025-01-30 05:07:43 dovecot_login authenticator failed for ([36.154.247.90]) [36.154.247.90]:45963: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.101.63.176
description:
[2025-01-30 05:07:56 +0100] info [webmaild] 200.101.63.176 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.204.54
description:
[2025-01-30 05:08:08 +0100] info [webmaild] 191.7.204.54 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.200.66.164
description:
Jan 30 05:08:03 ait sshd[690535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 05:07:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.66.164
description:
Jan 30 05:08:03 ait sshd[690535]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.200.66.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:08:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.247.90
description:
Jan 30 05:07:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:09:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
description:
Jan 30 05:09:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
description:
2025-01-30 05:09:34 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (ceptelaor) [188.149.132.246]:45041: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:05-08.171.244.129.243


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 197.242.157.213
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:05-08.197.242.157.213


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 05:10:24 ait sshd[691533]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.132.56.114
description:
Jan 30 05:09:54 ait sshd[691085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.132.56.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 05:10:24 ait sshd[691533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.132.56.114
description:
Jan 30 05:09:54 ait sshd[691085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.132.56.114


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 05:10:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.132.56.114
description:
Jan 30 05:11:33 ait sshd[691926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.132.56.114


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.157.148.187
description:
Jan 30 05:10:44 ait sshd[691711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.157.148.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.200.169
description:
[2025-01-30 05:11:02 +0100] info [webmaild] 27.147.200.169 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.200.66.164
description:
Jan 30 05:11:04 ait sshd[691749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.170.13
description:
2025-01-30 05:11:16 dovecot_login authenticator failed for ([127.0.0.1]) [117.205.170.13]:49878: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.94.74
description:
[2025-01-30 05:11:19 +0100] info [webmaild] 45.160.94.74 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-01-30 05:11:23 dovecot_login authenticator failed for wsip-64-207-225-55.tu.ok.cox.net ([127.0.0.1]) [64.207.225.55]:41008: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.107.67
description:
2025-01-30 05:10:43 dovecot_plain authenticator failed for v2202409233646285895.ultrasrv.de (repht) [152.53.107.67]:59222: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
description:
Jan 30 05:11:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-01-30 05:11:27 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:38646: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
description:
Jan 30 05:11:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.205.170.13
description:
Jan 30 05:11:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.205.170.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.157.148.187
description:
Jan 30 05:10:44 ait sshd[691711]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.157.148.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.66.164
description:
Jan 30 05:11:04 ait sshd[691749]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.200.66.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.132.56.114
description:
Jan 30 05:11:33 ait sshd[691926]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.132.56.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.107.67
description:
Jan 30 05:10:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
description:
2025-01-30 05:12:37 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:23560: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.157.148.187
description:
Jan 30 05:12:04 ait sshd[692133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.157.148.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
description:
Jan 30 05:12:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
description:
Jan 30 05:12:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.200.66.164
description:
Jan 30 05:12:25 ait sshd[692237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.176.16
description:
2025-01-30 05:11:45 dovecot_plain authenticator failed for ([180.7.176.16]) [180.7.176.16]:33532: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 8.218.83.143
domain: 136.243.145.84:443
description:
IM360 WAF: PHP Injection Low value||MV:/<?echo(md5(\"hi\"));?> /tmp/index1.php||RSV:6.65||T:APACHE||SC:/home/aitopen/public_html/index.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-01-30 05:11:51 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:52786: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.157.148.187
description:
Jan 30 05:12:04 ait sshd[692133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.157.148.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.59.151.155
description:
[2025-01-30 05:12:12 +0100] info [webmaild] 187.59.151.155 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
description:
2025-01-30 05:11:40 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:33582: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-01-30 05:11:55 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:55074: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Jan 30 05:11:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Jan 30 05:11:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.176.16
description:
Jan 30 05:11:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.176.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77350515
name: IM360 WAF: Block OS file access attempt
abuser: 8.218.83.143
domain: 136.243.145.84:443
description:
IM360 WAF: Block OS file access attempt||MV:/usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\"hi\"));?> /tmp/index1.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.66.164
description:
Jan 30 05:12:25 ait sshd[692237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.200.66.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.183.0.42
description:
[2025-01-30 05:11:50 +0100] info [webmaild] 201.183.0.42 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.157.148.187
description:
Jan 30 05:12:07 ait sshd[692133]: Failed password for invalid user server from 45.157.148.187 port 35302 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.115.91
description:
Jan 30 05:11:58 ait sshd[692111]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.115.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.115.91
description:
Jan 30 05:11:58 ait sshd[692111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.115.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
description:
2025-01-30 05:12:26 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:51364: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Jan 30 05:13:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.115.91
description:
Jan 30 05:13:38 ait sshd[692700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.115.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-01-30 05:12:44 dovecot_login authenticator failed for ([77.87.103.131]) [77.87.103.131]:57372: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.132.56.114
description:
Jan 30 05:12:58 ait sshd[692447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.132.56.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 30 05:13:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-30 05:13:36 dovecot_plain authenticator failed for ([140.246.50.122]) [203.34.57.78]:51426: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 05:13:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
description:
Jan 30 05:12:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
description:
2025-01-30 05:12:53 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:60420: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-01-30 05:13:17 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:51454: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Jan 30 05:12:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.132.56.114
description:
Jan 30 05:12:58 ait sshd[692447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.132.56.114


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.115.91
description:
Jan 30 05:13:38 ait sshd[692700]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.115.91 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.91
description:
Jan 30 05:13:40 ait sshd[692700]: Disconnected from invalid user ftpuser 103.174.115.91 port 39860 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.141.59.203
description:
Jan 30 05:13:50 ait sshd[692795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.141.59.203  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 30 05:15:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Jan 30 05:15:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 30 05:14:42 ait sshd[693027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.20.42.216
description:
[2025-01-30 05:15:00 +0100] info [webmaild] 190.20.42.216 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.86.57.168
description:
[2025-01-30 05:15:18 +0100] info [webmaild] 95.86.57.168 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 30 05:15:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 30 05:14:42 ait sshd[693027]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 30 05:15:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-30 05:15:11 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (lostira) [91.200.226.218]:33014: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
description:
Jan 30 05:15:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
description:
2025-01-30 05:15:29 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:33370: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-01-30 05:15:34 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:58976: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-30 05:15:40 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:52303: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-30 05:15:08 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (buctism) [109.67.154.24]:53336: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.205.251
description:
Jan 30 05:15:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.205.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.141.59.203
description:
Jan 30 05:16:19 ait sshd[693618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.141.59.203  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Jan 30 05:16:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-01-30 05:16:32 dovecot_plain authenticator failed for (acking) [185.113.49.23]:40960: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-01-30 05:16:34 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:44710: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.205.251
description:
2025-01-30 05:15:44 dovecot_plain authenticator failed for ([183.236.205.251]) [183.236.205.251]:37651: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-01-30 05:15:49 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:45984: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-01-30 05:16:04 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:53986: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Jan 30 05:16:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-15.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Jan 30 05:15:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.124.171.9
description:
[2025-01-30 05:15:48 +0100] info [webmaild] 189.124.171.9 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Jan 30 05:16:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 30 05:16:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-30 05:16:11 dovecot_plain authenticator failed for 9498.telnet.bg (viral) [87.254.165.100]:43436: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.191.151.244
description:
[2025-01-30 05:16:12 +0100] info [webmaild] 179.191.151.244 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-01-30 05:16:23 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:38953: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.162.13
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS23B00195Y||WPU:ADS23B00195Y||RSV:6.65||T:APACHE||MV:05-16.45.61.162.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
description:
Jan 30 05:16:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.130.108.153
description:
[2025-01-30 05:20:03 +0100] info [webmaild] 179.130.108.153 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.184.80
description:
Jan 30 05:20:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.209.240
description:
[2025-01-30 05:19:52 +0100] info [webmaild] 197.185.209.240 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.79.235
description:
2025-01-30 05:20:03 dovecot_login authenticator failed for ([127.0.0.1]) [218.1.79.235]:35895: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
description:
2025-01-30 05:20:06 dovecot_plain authenticator failed for (jecti) [65.20.184.80]:37901: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.205
description:
Jan 30 05:19:47 ait sshd[694656]: error: maximum authentication attempts exceeded for root from 218.92.0.205 port 21438 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.18.11.94
description:
Jan 30 05:20:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.18.11.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.18.11.94
description:
2025-01-30 05:20:11 dovecot_login authenticator failed for ([127.0.0.1]) [37.18.11.94]:39010: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.205
description:
Jan 30 05:19:41 ait sshd[694656]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:21:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.223.187.146
description:
Jan 30 05:20:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.223.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.22
description:
47.128.123.22 - - [30/Jan/2025:05:21:17 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21667838 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short%2Cmedium&filter_course-language=120&filtering=1&instructor=2&level=intermediate%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.223.187.146
description:
2025-01-30 05:20:46 dovecot_plain authenticator failed for ([222.223.187.146]) [222.223.187.146]:48044: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Jan 30 05:20:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-01-30 05:20:57 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:44420: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 05:21:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 30 05:22:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-30 05:22:07 dovecot_plain authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:53719: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Jan 30 05:22:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-01-30 05:22:33 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:59840: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Jan 30 05:22:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-01-30 05:22:29 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:56997: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.251.129
description:
[2025-01-30 05:23:02 +0100] info [webmaild] 45.183.251.129 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.147.231
description:
2025-01-30 05:23:06 dovecot_login authenticator failed for ([127.0.0.1]) [191.59.147.231]:45150: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.94.174.231
description:
Jan 30 05:23:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.94.174.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.216
description:
2025-01-30 05:22:44 dovecot_plain authenticator failed for 111-70-39-216.emome-ip.hinet.net [111.70.39.216]:58967: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.94.174.231
description:
2025-01-30 05:23:33 dovecot_login authenticator failed for ([109.94.174.231]) [109.94.174.231]:50481: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-30 05:22:56 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:38600: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.81.118
description:
[2025-01-30 05:23:06 +0100] info [webmaild] 45.174.81.118 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Jan 30 05:23:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.216
description:
Jan 30 05:22:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 30 05:22:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.62.136.178
description:
[2025-01-30 05:24:32 +0100] info [whostmgrd] 39.62.136.178 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-01-30 05:23:41 dovecot_login authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:65092: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.120.3.3
description:
[2025-01-30 05:23:56 +0100] info [webmaild] 160.120.3.3 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.210.173.145
description:
[2025-01-30 05:23:57 +0100] info [webmaild] 201.210.173.145 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.62.136.178
description:
[2025-01-30 05:24:41 +0100] info [whostmgrd] 39.62.136.178 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:25:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-01-30 05:25:22 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:50182: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
description:
Jan 30 05:25:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
description:
2025-01-30 05:25:32 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:38622: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Jan 30 05:25:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Jan 30 05:25:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-01-30 05:25:41 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:2982: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
description:
Jan 30 05:25:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
description:
2025-01-30 05:25:50 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:40177: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.246.34.19
description:
Jan 30 05:26:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.246.34.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
description:
Jan 30 05:26:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.246.34.19
description:
2025-01-30 05:26:15 dovecot_plain authenticator failed for ([61.246.34.19]) [61.246.34.19]:37740: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:26:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
description:
2025-01-30 05:26:26 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:48496: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 30 05:26:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Jan 30 05:26:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-01-30 05:26:51 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:9394: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.64.44.222
description:
[2025-01-30 05:27:02 +0100] info [webmaild] 187.64.44.222 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 05:27:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.42.67
description:
[2025-01-30 05:27:14 +0100] info [webmaild] 168.228.42.67 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-30 05:26:41 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:33848: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
description:
2025-01-30 05:27:46 dovecot_plain authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:53656: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.185.246.75
description:
[2025-01-30 05:27:50 +0100] info [webmaild] 200.185.246.75 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Jan 30 05:27:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
description:
Jan 30 05:27:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-01-30 05:27:57 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:40050: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.34.162.245
description:
[2025-01-30 05:28:15 +0100] info [webmaild] 77.34.162.245 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.119.204.57
description:
2025-01-30 05:29:03 dovecot_login authenticator failed for ([127.0.0.1]) [106.119.204.57]:37722: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-28.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
description:
Jan 30 05:28:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
description:
2025-01-30 05:28:54 dovecot_login authenticator failed for ([127.0.0.1]) [179.124.54.6]:55221: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.119.204.57
description:
Jan 30 05:29:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.119.204.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 30 05:29:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-30 05:30:57 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (tylatin) [62.63.230.241]:36404: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.136.104
description:
[2025-01-30 05:30:58 +0100] info [webmaild] 157.100.136.104 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.3.137.164
description:
[2025-01-30 05:31:07 +0100] info [webmaild] 177.3.137.164 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.149.125
description:
Jan 30 05:31:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.149.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 05:31:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.230.214.243
description:
Jan 30 05:31:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.230.214.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 30 05:30:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.230.214.243
description:
Jan 30 05:31:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.230.214.243 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.193.231.137
description:
[2025-01-30 05:31:45 +0100] info [webmaild] 191.193.231.137 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.66.182.100
description:
[2025-01-30 05:32:00 +0100] info [webmaild] 102.66.182.100 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS23B00120Y||WPU:ADS23B00120Y||RSV:6.65||T:APACHE||MV:05-32.170.205.31.106


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 30 05:32:55 ait sshd[699634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 30 05:32:55 ait sshd[699634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.188.217.244
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:awadzie@ait.edu.gh||WPU:awadzie@ait.edu.gh||RSV:6.65||T:APACHE||MV:05-33.5.188.217.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
description:
2025-01-30 05:33:54 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:50784: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
description:
2025-01-30 05:34:19 dovecot_plain authenticator failed for (eleterm) [65.20.133.208]:57131: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
description:
Jan 30 05:33:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.215.126.22
description:
Jan 30 05:33:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.215.126.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.95.119.74
description:
Jan 30 05:34:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.95.119.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.95.119.74
description:
2025-01-30 05:34:32 dovecot_login authenticator failed for ([127.0.0.1]) [212.95.119.74]:54171: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.164.136
description:
Jan 30 05:34:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.164.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.215.126.22
description:
2025-01-30 05:33:44 dovecot_plain authenticator failed for ([60.215.126.22]) [60.215.126.22]:45481: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.169.41.188
description:
Jan 30 05:35:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.169.41.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-30 05:35:08 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:47624: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 30 05:35:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-30 05:35:17 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:52320: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
description:
2025-01-30 05:35:27 dovecot_login authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:44776: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.164.136
description:
2025-01-30 05:34:40 dovecot_login authenticator failed for ([127.0.0.1]) [117.253.164.136]:34696: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.36.222.9
description:
[2025-01-30 05:34:42 +0100] info [webmaild] 189.36.222.9 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.186.19
description:
[2025-01-30 05:34:46 +0100] info [webmaild] 187.84.186.19 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.113
description:
Jan 30 05:35:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.218.42.50
description:
[2025-01-30 05:35:29 +0100] info [webmaild] 189.218.42.50 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.41.188
description:
2025-01-30 05:35:07 dovecot_login authenticator failed for ([127.0.0.1]) [113.169.41.188]:49779: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.225.153
description:
Jan 30 05:35:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.225.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.221.225.153
description:
2025-01-30 05:35:16 dovecot_login authenticator failed for ([127.0.0.1]) [117.221.225.153]:35418: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
description:
2025-01-30 05:35:43 dovecot_login authenticator failed for ([121.141.194.159]) [121.141.194.159]:36876: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
description:
Jan 30 05:35:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.60.224
description:
[2025-01-30 05:35:40 +0100] info [webmaild] 170.82.60.224 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-30 05:35:56 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (enophudous) [217.215.254.115]:56368: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.135.251
description:
Jan 30 05:37:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.135.251
description:
2025-01-30 05:37:16 dovecot_plain authenticator failed for (notbum) [157.245.135.251]:49864: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:36:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 30 05:37:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-30 05:37:14 dovecot_plain authenticator failed for (drefulass) [89.23.210.188]:46583: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-30 05:37:44 dovecot_plain authenticator failed for (scroplus) [37.224.119.19]:48078: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.40.162.126
description:
Jan 30 05:37:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.40.162.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
description:
2025-01-30 05:38:07 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:60953: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.72.249.5
description:
[2025-01-30 05:38:26 +0100] info [webmaild] 105.72.249.5 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.167
description:
47.128.118.167 - - [30/Jan/2025:05:38:27 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23182411 HTTP/2.0" 302 0 iric.us "https://iric.us/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.167


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
description:
Jan 30 05:38:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Jan 30 05:38:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-01-30 05:38:22 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:53184: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.42.119.88
description:
[2025-01-30 05:38:43 +0100] info [webmaild] 212.42.119.88 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.73.107.150
description:
[2025-01-30 05:39:15 +0100] info [webmaild] 103.73.107.150 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.105.31
description:
[2025-01-30 05:39:36 +0100] info [webmaild] 131.161.105.31 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 30 05:40:33 ait sshd[702160]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 30 05:40:33 ait sshd[702160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.40.162.126
description:
Jan 30 05:40:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.40.162.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.73.75.82
description:
2025-01-30 05:41:29 dovecot_login authenticator failed for ([212.73.75.82]) [212.73.75.82]:57798: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.184
description:
47.128.22.184 - - [30/Jan/2025:05:41:37 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10542803 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=118%2C79%2C95&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.73.75.82
description:
Jan 30 05:41:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.73.75.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-30 05:42:33 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:37340: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 30 05:42:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-42.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
description:
2025-01-30 05:41:41 dovecot_login authenticator failed for (58-115-53-66.twt1.com.tw) [58.115.53.66]:56186: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 30 05:43:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.87.156
description:
[2025-01-30 05:42:52 +0100] info [webmaild] 157.100.87.156 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.155.95.172
description:
[2025-01-30 05:43:08 +0100] info [webmaild] 37.155.95.172 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-30 05:42:43 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:40379: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-42.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-30 05:43:28 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:43078: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.87.155
description:
[2025-01-30 05:43:50 +0100] info [webmaild] 191.5.87.155 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 30 05:44:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.91.64.245
description:
[2025-01-30 05:44:04 +0100] info [webmaild] 187.91.64.245 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-30 05:44:05 dovecot_plain authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:53892: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-30 05:44:56 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (mized) [81.237.110.29]:41792: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 05:44:58 ait sshd[703574]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Jan 30 05:45:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-30 05:44:53 dovecot_plain authenticator failed for (brierm) [102.53.15.56]:36047: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Jan 30 05:45:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 05:44:58 ait sshd[703574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 30 05:44:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 30 05:44:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-30 05:45:32 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:47697: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-01-30 05:45:25 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:40083: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-01-30 05:45:15 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:60840: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 30 05:45:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Jan 30 05:45:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-01-30 05:45:42 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:59361: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 05:46:15 ait sshd[704249]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 05:46:15 ait sshd[704249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 30 05:46:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-30 05:46:42 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:60212: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.193.104
description:
[2025-01-30 05:46:45 +0100] info [webmaild] 45.186.193.104 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.114
description:
[2025-01-30 05:47:27 +0100] info [webmaild] 213.230.86.114 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.253.212.63
description:
[2025-01-30 05:47:32 +0100] info [webmaild] 188.253.212.63 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
description:
Jan 30 05:48:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
description:
2025-01-30 05:48:13 dovecot_plain authenticator failed for ([195.158.19.6]) [195.158.19.6]:48682: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 30 05:48:39 ait sshd[705003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 05:48:39 ait sshd[705003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.69.240
description:
[2025-01-30 05:48:06 +0100] info [webmaild] 182.48.69.240 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
description:
Jan 30 05:48:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-01-30 05:48:25 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:60405: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Jan 30 05:49:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-01-30 05:49:35 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:56213: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:05-50.157.230.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-01-30 05:49:51 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:9151: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 30 05:50:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-01-30 05:50:01 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:49891: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 30 05:50:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-30 05:50:24 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:50109: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Jan 30 05:49:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-30 05:50:13 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:41006: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Jan 30 05:49:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.227.218
description:
Jan 30 05:50:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.227.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.227.218
description:
2025-01-30 05:50:11 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:53064: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.142.69.29
description:
[2025-01-30 05:51:16 +0100] info [webmaild] 103.142.69.29 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.217.163.52
description:
[2025-01-30 05:51:32 +0100] info [webmaild] 191.217.163.52 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
description:
Jan 30 05:51:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 05:51:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 05:51:16 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (palin) [51.255.84.180]:53876: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-01-30 05:51:18 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:35445: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.1.37.151
description:
[2025-01-30 05:50:44 +0100] info [webmaild] 186.1.37.151 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
description:
2025-01-30 05:51:09 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:46771: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Jan 30 05:51:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.63.37
description:
Jan 30 05:52:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.47.63.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.118.53
description:
Jan 30 05:51:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.118.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
description:
2025-01-30 05:52:01 dovecot_plain authenticator failed for ([167.250.118.53]) [167.250.118.53]:35494: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.107.211.196
description:
[2025-01-30 05:52:09 +0100] info [webmaild] 187.107.211.196 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:52:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.47.63.37
description:
2025-01-30 05:52:14 dovecot_plain authenticator failed for ([95.47.63.37]) [95.47.63.37]:52568: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 30 05:52:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 05:52:05 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (tubinvul) [176.37.212.85]:35959: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 05:53:33 ait sshd[706934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 05:53:33 ait sshd[706934]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 30 05:54:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-30 05:54:19 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (hizer) [81.16.170.117]:37440: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:54:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.81.29.250
description:
[2025-01-30 05:54:29 +0100] info [webmaild] 177.81.29.250 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 204.157.177.66
description:
[2025-01-30 05:55:17 +0100] info [webmaild] 204.157.177.66 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 05:55:27 ait sshd[707556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 05:55:27 ait sshd[707556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:54:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.235.61
description:
[2025-01-30 05:55:08 +0100] info [webmaild] 177.126.235.61 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-55.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
description:
Jan 30 05:56:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
description:
2025-01-30 05:56:11 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:48152: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.148.10.71
domain: www.a-rapp.ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/titlemas/public_html/a-rapp.ait-edu.us/wp-admin/images/index.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 05:56:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-01-30 05:56:33 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:56740: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Jan 30 05:55:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.133.25.179
description:
[2025-01-30 05:56:00 +0100] info [webmaild] 190.133.25.179 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-01-30 05:55:53 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:50806: 535 Incorrect authentication data (set_id=assdas4)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 45.148.10.71
domain: www.a-rapp.ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:05-56.45.148.10.71||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Jan 30 05:56:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 30 05:55:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-30 05:55:41 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:36110: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-01-30 05:56:44 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:64708: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:56:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 30 05:57:18 ait sshd[708145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Jan 30 05:56:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 30 05:57:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-30 05:57:02 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:34872: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-01-30 05:58:37 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:4205: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 05:57:45 ait sshd[708214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Jan 30 05:58:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 05:57:45 ait sshd[708214]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.221.201.75
description:
[2025-01-30 05:58:19 +0100] info [webmaild] 179.221.201.75 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:58:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.146.229.94
description:
[2025-01-30 05:59:06 +0100] info [webmaild] 197.146.229.94 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
description:
Jan 30 05:59:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
description:
2025-01-30 05:59:19 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:65318: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
description:
2025-01-30 05:59:30 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:52683: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.91.107.199
description:
[2025-01-30 05:59:38 +0100] info [cpaneld] 138.91.107.199 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Jan 30 05:58:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-01-30 05:58:46 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:35725: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.39.152.121
description:
[2025-01-30 05:59:06 +0100] info [webmaild] 187.39.152.121 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
description:
Jan 30 05:59:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:59:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.151.89
description:
[2025-01-30 05:59:58 +0100] info [webmaild] 186.224.151.89 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.38.100
description:
47.128.38.100 - - [30/Jan/2025:06:00:15 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16873349 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?duration=short&filter_course-language=183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.38.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.193.106.140
description:
Jan 30 06:01:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.193.106.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Jan 30 06:01:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-01-30 06:01:16 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:38730: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.193.106.140
description:
2025-01-30 06:01:27 dovecot_plain authenticator failed for ([122.193.106.140]) [122.193.106.140]:37287: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.101.44.224
description:
[2025-01-30 06:02:09 +0100] info [webmaild] 177.101.44.224 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.41.7.80
description:
[2025-01-30 06:02:58 +0100] info [webmaild] 179.41.7.80 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:03:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.152.95.166
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:masomani@ait.edu.gh||WPU:masomani@ait.edu.gh||RSV:6.65||T:APACHE||MV:06-03.185.152.95.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.33.13
description:
47.128.33.13 - - [30/Jan/2025:06:03:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=2544292 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?duration=short&filter_course-language=120&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.88.87
description:
[2025-01-30 06:02:58 +0100] info [webmaild] 157.100.88.87 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 30 06:04:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 122.152.55.65
description:
[2025-01-30 06:03:50 +0100] info [webmaild] 122.152.55.65 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.197
description:
2025-01-30 06:04:32 dovecot_plain authenticator failed for (nlos-200-197.zamnet.zm) [196.46.200.197]:57792: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.190.87
description:
Jan 30 06:04:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.190.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.190.87
description:
2025-01-30 06:04:36 dovecot_login authenticator failed for ([180.7.190.87]) [180.7.190.87]:51832: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 30 06:04:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-30 06:04:19 dovecot_login authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:10747: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.197
description:
Jan 30 06:04:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-30 06:05:33 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:53747: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-01-30 06:04:40 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:50657: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Jan 30 06:04:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.33.36.254
description:
Jan 30 06:05:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.33.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 06:05:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.33.36.254
description:
2025-01-30 06:05:22 dovecot_plain authenticator failed for ([102.33.36.254]) [102.33.36.254]:35125: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 30 06:05:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-01-30 06:04:51 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:51120: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 06:05:10 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:38457: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:06:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.72.131
description:
Jan 30 06:06:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.72.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.72.131
description:
2025-01-30 06:06:28 dovecot_login authenticator failed for ([127.0.0.1]) [178.66.72.131]:53045: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
description:
2025-01-30 06:06:36 dovecot_login authenticator failed for ([127.0.0.1]) [201.132.7.7]:40545: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.176.64
description:
[2025-01-30 06:05:57 +0100] info [webmaild] 45.165.176.64 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
description:
Jan 30 06:06:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
description:
2025-01-30 06:06:44 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:46388: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
description:
Jan 30 06:06:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
description:
2025-01-30 06:06:56 dovecot_plain authenticator failed for ([103.59.134.177]) [103.59.134.177]:5299: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.202.144
description:
[2025-01-30 06:07:05 +0100] info [webmaild] 45.4.202.144 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
description:
Jan 30 06:06:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.196.140.109
description:
[2025-01-30 06:06:45 +0100] info [webmaild] 200.196.140.109 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
description:
Jan 30 06:07:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
description:
2025-01-30 06:07:32 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:49228: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-08.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:07:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
description:
2025-01-30 06:07:43 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:41027: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.189.225.136
description:
[2025-01-30 06:07:57 +0100] info [webmaild] 45.189.225.136 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
description:
Jan 30 06:07:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 30 06:08:52 ait sshd[712673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.27.155.31
description:
[2025-01-30 06:10:00 +0100] info [webmaild] 186.27.155.31 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 06:10:29 ait sshd[713449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.44.76.103
description:
Jan 30 06:10:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.44.76.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-01-30 06:10:37 dovecot_login authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:56320: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 06:10:29 ait sshd[713449]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 06:10:32 dovecot_plain authenticator failed for (metys) [207.188.157.230]:23043: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 06:10:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.122.48.91
description:
Jan 30 06:10:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.122.48.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.189.112.89
description:
[2025-01-30 06:10:56 +0100] info [webmaild] 191.189.112.89 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:11:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 30 06:11:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-30 06:11:34 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:49672: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.141.195.8
description:
[2025-01-30 06:10:48 +0100] info [webmaild] 192.141.195.8 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.122.48.91
description:
2025-01-30 06:10:50 dovecot_login authenticator failed for ([124.206.196.124]) [123.122.48.91]:36931: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:11:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Jan 30 06:11:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-01-30 06:11:47 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:41019: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.105.83
description:
[2025-01-30 06:11:49 +0100] info [webmaild] 45.187.105.83 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:12:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.255.54
description:
2025-01-30 06:12:56 dovecot_plain authenticator failed for ([220.179.255.54]) [220.179.255.54]:33579: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 30 06:13:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-30 06:13:09 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:60422: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 06:12:54 ait sshd[713952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 06:12:54 ait sshd[713952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
description:
Jan 30 06:12:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:12:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.213.200.181
description:
[2025-01-30 06:14:08 +0100] info [webmaild] 186.213.200.181 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:14:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:14:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.141.194.141
description:
[2025-01-30 06:14:51 +0100] info [webmaild] 192.141.194.141 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.229.83.18
description:
[2025-01-30 06:14:57 +0100] info [webmaild] 103.229.83.18 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.107.67
description:
2025-01-30 06:16:02 dovecot_plain authenticator failed for v2202409233646285895.ultrasrv.de (catrabst) [152.53.107.67]:56542: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.17.13
description:
47.128.17.13 - - [30/Jan/2025:06:16:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19633406 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C125%2C106&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.130.2
description:
2025-01-30 06:15:59 dovecot_login authenticator failed for ([127.0.0.1]) [78.36.130.2]:42225: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-01-30 06:16:20 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:37171: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.64.9
description:
[2025-01-30 06:15:45 +0100] info [webmaild] 157.100.64.9 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.107.67
description:
Jan 30 06:16:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-30 06:16:29 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:37560: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.99.242.32
description:
Jan 30 06:16:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.99.242.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.99.242.32
description:
2025-01-30 06:16:13 dovecot_login authenticator failed for ([127.0.0.1]) [125.99.242.32]:58159: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Jan 30 06:16:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Jan 30 06:16:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.36.130.2
description:
Jan 30 06:15:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.36.130.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-30 06:17:12 dovecot_plain authenticator failed for (emanicome) [93.159.152.6]:43174: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.123.128.195
description:
Jan 30 06:17:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.123.128.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 06:16:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
description:
2025-01-30 06:17:26 dovecot_login authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com ([127.0.0.1]) [44.211.191.117]:57898: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 30 06:17:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
description:
Jan 30 06:17:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 06:18:31 ait sshd[715991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.206.176
description:
[2025-01-30 06:18:43 +0100] info [webmaild] 45.166.206.176 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.79.154
description:
[2025-01-30 06:18:53 +0100] info [webmaild] 131.161.79.154 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 06:18:31 ait sshd[715991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-30 06:19:48 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (xythi) [91.200.226.218]:57124: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.173
description:
47.128.99.173 - - [30/Jan/2025:06:20:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16325325 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=118%2C121%2C198&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 06:19:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 30 06:19:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.137.231.241
description:
[2025-01-30 06:19:47 +0100] info [webmaild] 103.137.231.241 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 06:19:45 dovecot_plain authenticator failed for (myolly) [81.211.77.58]:42201: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.252.177
description:
Jan 30 06:20:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.252.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.252.177
description:
2025-01-30 06:20:25 dovecot_plain authenticator failed for ([117.4.252.177]) [117.4.252.177]:57423: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 30 06:20:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-30 06:20:48 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:45179: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 06:21:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 06:21:05 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (wegroses) [51.255.84.180]:38470: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-21.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.106.129.175
description:
[2025-01-30 06:21:51 +0100] info [webmaild] 200.106.129.175 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.40
description:
47.128.99.40 - - [30/Jan/2025:06:22:39 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20058506 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=30%2C125&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 30 06:22:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-30 06:22:45 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:46892: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.95.169.49
description:
[2025-01-30 06:22:49 +0100] info [webmaild] 187.95.169.49 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 30 06:22:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-30 06:22:34 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:48251: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.210.9
description:
[2025-01-30 06:22:39 +0100] info [webmaild] 187.108.210.9 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Jan 30 06:23:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-01-30 06:23:14 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:50668: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
description:
Jan 30 06:23:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 30 06:23:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.64.128
description:
2025-01-30 06:24:07 dovecot_plain authenticator failed for ([61.2.64.128]) [61.2.64.128]:42240: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
description:
2025-01-30 06:23:36 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:39998: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-30 06:23:37 dovecot_plain authenticator failed for (arousande) [102.53.15.17]:56445: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.130.10
description:
[2025-01-30 06:23:41 +0100] info [webmaild] 177.200.130.10 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.64.128
description:
Jan 30 06:24:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.64.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-01-30 06:25:06 dovecot_login authenticator failed for ([127.0.0.1]) [102.215.188.37]:34504: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:24:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 06:24:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 30 06:24:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-30 06:24:32 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:35868: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Jan 30 06:24:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-01-30 06:24:59 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:50094: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 06:26:07 ait sshd[718495]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 41052


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 30 06:26:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 06:26:07 ait sshd[718495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 06:25:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 06:25:12 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:50693: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Jan 30 06:25:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-01-30 06:25:15 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:52988: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.135.171
description:
[2025-01-30 06:25:45 +0100] info [webmaild] 177.131.135.171 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 06:26:24 ait sshd[718647]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 57132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.123.225.216
description:
[2025-01-30 06:26:33 +0100] info [webmaild] 200.123.225.216 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 30 06:26:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.15.105
description:
Jan 30 06:26:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.15.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.135.181.49
description:
[2025-01-30 06:27:06 +0100] info [webmaild] 185.135.181.49 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
description:
Jan 30 06:26:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
description:
2025-01-30 06:26:21 dovecot_plain authenticator failed for ([223.100.248.64]) [223.100.248.64]:48355: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 06:26:24 ait sshd[718647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-30 06:26:36 dovecot_plain authenticator failed for ([211.105.223.49]) [211.105.223.49]:52150: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.15.105
description:
2025-01-30 06:26:42 dovecot_login authenticator failed for ([186.200.123.85]) [201.63.15.105]:42904: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 30 06:27:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-30 06:27:05 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:40470: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 06:27:10 ait sshd[718751]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 41122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.33.228
description:
[2025-01-30 06:27:58 +0100] info [webmaild] 45.181.33.228 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 06:27:10 ait sshd[718751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:28:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-01-30 06:28:48 dovecot_login authenticator failed for ([127.0.0.1]) [77.235.25.35]:49423: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.250
description:
47.128.123.250 - - [30/Jan/2025:06:28:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9847727 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?filter_course-language=121%2C183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.7.153
description:
Jan 30 06:28:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.7.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Jan 30 06:28:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.7.153
description:
2025-01-30 06:28:47 dovecot_login authenticator failed for ([119.207.7.153]) [119.207.7.153]:36947: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-30 06:28:51 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:46195: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.155.8.109
description:
2025-01-30 06:29:03 dovecot_login authenticator failed for 109.sub-166-155-8.myvzw.com [166.155.8.109]:49498: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.108.46
description:
Jan 30 06:29:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.108.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.123.128.195
description:
Jan 30 06:28:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.123.128.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 06:28:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.123.128.195
description:
2025-01-30 06:28:41 dovecot_login authenticator failed for ([127.0.0.1]) [175.123.128.195]:51166: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 30 06:28:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.8.109
description:
Jan 30 06:29:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.8.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.108.46
description:
2025-01-30 06:29:07 dovecot_plain authenticator failed for ([212.90.108.46]) [212.90.108.46]:53987: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.46.175.163
description:
[2025-01-30 06:30:07 +0100] info [webmaild] 77.46.175.163 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 06:29:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 30 06:30:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-30 06:30:52 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:46804: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-01-30 06:30:39 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:59302: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Jan 30 06:30:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 61.6.194.92
description:
[2025-01-30 06:30:53 +0100] info [webmaild] 61.6.194.92 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.163.1
description:
[2025-01-30 06:30:55 +0100] info [webmaild] 168.232.163.1 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.87.86
description:
2025-01-30 06:31:58 dovecot_plain authenticator failed for (187-93-87-86.customer.tdatabrasil.net.br) [187.93.87.86]:45531: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.157.130.199
description:
[2025-01-30 06:31:44 +0100] info [webmaild] 132.157.130.199 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.87.86
description:
Jan 30 06:31:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.87.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Jan 30 06:31:59 ait sshd[720687]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-01-30 06:32:05 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:45013: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Jan 30 06:31:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-01-30 06:31:43 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:47133: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-30 06:31:52 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:59550: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.154
description:
Jan 30 06:31:59 ait sshd[720687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.154  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.167.128
description:
[2025-01-30 06:31:45 +0100] info [webmaild] 177.222.167.128 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 30 06:31:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Jan 30 06:32:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Jan 30 06:32:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.53
description:
Jan 30 06:33:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
description:
2025-01-30 06:33:06 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:44281: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-01-30 06:32:51 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:54888: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Jan 30 06:33:24 ait sshd[720957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.154
description:
Jan 30 06:33:24 ait sshd[720957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.154  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.72.19
description:
[2025-01-30 06:33:54 +0100] info [webmaild] 213.230.72.19 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.144.125
description:
Jan 30 06:33:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.144.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.144.125
description:
2025-01-30 06:33:16 dovecot_login authenticator failed for ([127.0.0.1]) [219.157.144.125]:40505: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.123.74
description:
2025-01-30 06:33:26 dovecot_login authenticator failed for ([127.0.0.1]) [202.4.123.74]:58754: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.123.74
description:
Jan 30 06:33:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.123.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 30 06:34:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-30 06:34:46 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:25060: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.59.64
description:
[2025-01-30 06:34:49 +0100] info [webmaild] 170.0.59.64 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.48.14
description:
47.128.48.14 - - [30/Jan/2025:06:34:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20179087 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/aaf8f9?panel=time" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.48.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.185.218.77
description:
[2025-01-30 06:34:43 +0100] info [webmaild] 191.185.218.77 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 30 06:34:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-30 06:34:54 dovecot_login authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:42729: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-35.15.206.171.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 30 06:36:06 ait sshd[722111]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.84.81.131
description:
[2025-01-30 06:35:44 +0100] info [webmaild] 206.84.81.131 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 30 06:36:06 ait sshd[722111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 30 06:37:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 06:37:06 ait sshd[722423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-30 06:37:05 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:54102: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 30 06:37:06 ait sshd[722423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.25.253.114
description:
[2025-01-30 06:38:00 +0100] info [webmaild] 223.25.253.114 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 30 06:37:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-30 06:37:16 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:30686: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.78
description:
2025-01-30 06:37:29 dovecot_login authenticator failed for (uM489EpLi) [141.98.10.78]:56970: 535 Incorrect authentication data (set_id=open)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 30 06:37:57 ait sshd[722704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-30 06:38:18 dovecot_plain authenticator failed for (photipyla) [109.166.70.166]:59833: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.23.31
description:
[2025-01-30 06:38:40 +0100] info [webmaild] 45.231.23.31 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.198.194.27
description:
[2025-01-30 06:38:46 +0100] info [webmaild] 46.198.194.27 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.78
description:
2025-01-30 06:38:14 dovecot_login authenticator failed for (l6fJdrW6NR) [141.98.10.78]:50987: 535 Incorrect authentication data (set_id=open)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 30 06:38:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.60.154
description:
Jan 30 06:39:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.60.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 30 06:39:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-30 06:39:21 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:50860: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.168.98
description:
[2025-01-30 06:39:31 +0100] info [webmaild] 181.191.168.98 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.60.154
description:
2025-01-30 06:39:36 dovecot_plain authenticator failed for ([220.172.60.154]) [220.172.60.154]:59261: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
description:
Jan 30 06:41:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 06:40:50 ait sshd[724279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 30 06:41:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.164.253.45
description:
Jan 30 06:41:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.164.253.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-30 06:41:30 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:45628: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.164.253.45
description:
2025-01-30 06:41:31 dovecot_login authenticator failed for ti0040a400-0553.bb.online.no ([127.0.0.1]) [85.164.253.45]:38097: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-01-30 06:41:59 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:50258: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 30 06:41:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-30 06:41:37 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:59304: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 30 06:41:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
description:
2025-01-30 06:41:09 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:51763: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 06:41:41 ait sshd[724562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 207.204.103.95
description:
[2025-01-30 06:41:53 +0100] info [webmaild] 207.204.103.95 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.190
description:
Jan 30 06:42:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.190
description:
2025-01-30 06:42:20 dovecot_plain authenticator failed for ([122.187.229.190]) [122.187.229.190]:46837: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.86.170
description:
[2025-01-30 06:42:32 +0100] info [webmaild] 84.54.86.170 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.19.123.101
description:
[2025-01-30 06:42:44 +0100] info [webmaild] 186.19.123.101 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.85.183.88
description:
Jan 30 06:43:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.85.183.88 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 30 06:43:59 ait sshd[725192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Jan 30 06:44:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-01-30 06:44:04 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:53180: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.122.152.227
description:
[2025-01-30 06:43:24 +0100] info [webmaild] 37.122.152.227 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-30 06:43:55 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:38193: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.85.183.88
description:
2025-01-30 06:43:10 dovecot_plain authenticator failed for a88.sub183.net78.udm.net (unforagged) [78.85.183.88]:59477: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Jan 30 06:43:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-01-30 06:44:23 dovecot_login authenticator failed for ([82.204.162.116]) [82.204.162.116]:50274: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 06:44:08 ait sshd[725353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-30 06:44:13 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:33950: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 30 06:44:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-01-30 06:44:25 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:63996: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 30 06:44:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Jan 30 06:44:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.162.46.212
description:
Jan 30 06:46:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.162.46.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:46:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.162.46.212
description:
2025-01-30 06:46:08 dovecot_login authenticator failed for ([127.0.0.1]) [14.162.46.212]:46874: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 06:45:58 ait sshd[726087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.21.174.234
description:
2025-01-30 06:45:59 dovecot_login authenticator failed for ([127.0.0.1]) [199.21.174.234]:45260: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 30 06:45:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 30 06:45:58 ait sshd[726087]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.212.55
description:
[2025-01-30 06:45:50 +0100] info [webmaild] 186.68.212.55 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.135.208
description:
Jan 30 06:46:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.135.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.135.208
description:
2025-01-30 06:46:08 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:54540: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.21.174.234
description:
Jan 30 06:45:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.21.174.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-30 06:45:57 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:29442: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.191.16.161
description:
[2025-01-30 06:46:56 +0100] info [webmaild] 187.191.16.161 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.42.1
description:
[2025-01-30 06:46:37 +0100] info [webmaild] 45.230.42.1 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.77.21.39
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:06-46.51.77.21.39


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.75.51
description:
[2025-01-30 06:47:48 +0100] info [webmaild] 45.176.75.51 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-48.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 30 06:49:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Jan 30 06:48:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-30 06:49:03 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:1028: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
description:
Jan 30 06:49:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Jan 30 06:49:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 30 06:48:52 ait sshd[727107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-01-30 06:48:59 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:53914: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
description:
2025-01-30 06:49:06 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:51922: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Jan 30 06:49:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 30 06:48:52 ait sshd[727107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Jan 30 06:50:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-01-30 06:49:10 dovecot_plain authenticator failed for (avels) [41.248.243.181]:40512: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.238
description:
2025-01-30 06:49:35 dovecot_plain authenticator failed for 111-70-23-238.emome-ip.hinet.net [111.70.23.238]:33806: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.77.220.62
description:
Jan 30 06:49:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.77.220.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 30 06:49:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-30 06:49:41 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:36150: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
description:
Jan 30 06:49:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-01-30 06:50:00 dovecot_login authenticator failed for ([183.237.33.162]) [183.237.33.162]:1960: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-01-30 06:49:12 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:38458: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 30 06:49:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-01-30 06:50:07 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:56930: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.77.220.62
description:
2025-01-30 06:49:31 dovecot_plain authenticator failed for ([61.77.220.62]) [61.77.220.62]:56722: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.178.65.35
description:
[2025-01-30 06:49:39 +0100] info [webmaild] 196.178.65.35 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Jan 30 06:49:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-30 06:49:12 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:34136: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-30 06:49:22 dovecot_plain authenticator failed for ([138.75.98.134]) [138.75.98.134]:32973: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.238
description:
Jan 30 06:49:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-01-30 06:49:10 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:54682: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 30 06:49:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.215.5.46
description:
[2025-01-30 06:50:28 +0100] info [webmaild] 37.215.5.46 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:50:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.130.131
description:
[2025-01-30 06:50:51 +0100] info [webmaild] 168.196.130.131 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
description:
Jan 30 06:50:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
description:
2025-01-30 06:50:13 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:35088: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Jan 30 06:50:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-01-30 06:50:17 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:4811: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Jan 30 06:51:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-01-30 06:51:33 dovecot_login authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:38090: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.248.64.227
description:
[2025-01-30 06:51:43 +0100] info [webmaild] 5.248.64.227 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Jan 30 06:51:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-01-30 06:51:56 dovecot_login authenticator failed for ([222.216.2.74]) [222.216.2.74]:46092: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.98.68
description:
[2025-01-30 06:53:28 +0100] info [webmaild] 128.201.98.68 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 06:53:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:53:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:53:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-53.171.244.129.243


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 06:54:23 ait sshd[729478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:55:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.198.133.91
description:
[2025-01-30 06:54:49 +0100] info [webmaild] 103.198.133.91 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.20.85.186
description:
[2025-01-30 06:54:16 +0100] info [webmaild] 187.20.85.186 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 06:54:23 ait sshd[729478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-55.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.132.172
description:
[2025-01-30 06:55:40 +0100] info [webmaild] 160.238.132.172 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.150
description:
2025-01-30 06:57:28 dovecot_plain authenticator failed for (nsg-corporate-150.230.187.122.airtel.in) [122.187.230.150]:58625: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.180.189
description:
[2025-01-30 06:57:37 +0100] info [webmaild] 177.124.180.189 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 30 06:57:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-30 06:57:39 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:54774: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:57:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.150
description:
Jan 30 06:57:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.2.202
description:
2025-01-30 06:58:21 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.2.202]:39750: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 06:58:21 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (plamigraic) [91.56.31.167]:63602: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 06:58:44 ait sshd[731096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.95.97.29
description:
Jan 30 06:59:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.95.97.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.79.235
description:
2025-01-30 06:58:14 dovecot_login authenticator failed for ([127.0.0.1]) [218.1.79.235]:37404: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.2.202
description:
Jan 30 06:58:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.44.198
description:
[2025-01-30 06:58:38 +0100] info [webmaild] 45.4.44.198 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 06:58:44 ait sshd[731096]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:58:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.124.75.218
description:
[2025-01-30 06:58:24 +0100] info [webmaild] 196.124.75.218 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 06:58:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:58:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.32.187
description:
Jan 30 06:59:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.32.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.32.187
description:
2025-01-30 06:59:06 dovecot_plain authenticator failed for ([203.124.32.187]) [203.124.32.187]:38983: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.79.235
description:
Jan 30 06:58:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.79.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Jan 30 06:58:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-01-30 06:58:17 dovecot_plain authenticator failed for (ratal) [5.167.48.130]:35442: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.97.29
description:
2025-01-30 06:59:10 dovecot_login authenticator failed for ([127.0.0.1]) [93.95.97.29]:44034: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.227.189
description:
2025-01-30 06:59:19 dovecot_plain authenticator failed for ([112.164.227.189]) [112.164.227.189]:45038: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.227.189
description:
Jan 30 06:59:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.227.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.239.229
description:
[2025-01-30 06:59:30 +0100] info [webmaild] 187.19.239.229 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 30 07:00:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.18.222.39
description:
Jan 30 07:00:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.18.222.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.18.222.39
description:
2025-01-30 07:00:29 dovecot_login authenticator failed for ([127.0.0.1]) [129.18.222.39]:33438: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-30 07:00:56 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:24778: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-30 07:01:01 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:63276: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-30 07:00:33 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:55490: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-01-30 07:00:51 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:5709: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.79.235
description:
2025-01-30 07:00:37 dovecot_login authenticator failed for ([127.0.0.1]) [218.1.79.235]:34451: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Jan 30 07:00:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 30 07:01:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-01-30 07:00:35 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:47805: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.79.235
description:
Jan 30 07:00:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.79.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 30 07:00:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Jan 30 07:00:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 07:01:45 ait sshd[732462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Jan 30 07:01:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
description:
2025-01-30 07:01:12 dovecot_login authenticator failed for ([127.0.0.1]) [222.163.236.235]:55292: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.130.107
description:
2025-01-30 07:01:19 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.130.107]:37951: 535 Incorrect authentication data (set_id=abio17)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-01.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-30 07:01:47 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:2276: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Jan 30 07:01:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 07:01:45 ait sshd[732462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-30 07:01:10 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:24295: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.130.107
description:
Jan 30 07:01:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.130.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 30 07:01:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 07:01:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-01-30 07:01:28 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:38884: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.107.226.3
description:
[2025-01-30 07:01:39 +0100] info [webmaild] 189.107.226.3 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 30 07:02:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-30 07:02:25 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:51894: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.21.169
description:
[2025-01-30 07:02:26 +0100] info [webmaild] 177.223.21.169 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.225.167.149
description:
[2025-01-30 07:02:20 +0100] info [webmaild] 187.225.167.149 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 30 07:02:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-30 07:02:48 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:45870: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.127.240
description:
47.128.127.240 - - [30/Jan/2025:07:02:24 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14316643 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C125%2C30&filter_course-language=79%2C121%2C95%2C183%2C99%2C118&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.127.240


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.214.164.161
description:
[2025-01-30 07:03:13 +0100] info [webmaild] 177.214.164.161 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Jan 30 07:03:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.209
description:
Jan 30 07:03:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.209
description:
2025-01-30 07:03:43 dovecot_plain authenticator failed for ([102.69.163.209]) [102.69.163.209]:42748: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:03:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 95.215.206.182
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-03.95.215.206.182||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-01-30 07:03:36 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:49742: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.198.235
description:
[2025-01-30 07:05:24 +0100] info [webmaild] 131.72.198.235 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.3.136
description:
2025-01-30 07:05:16 dovecot_login authenticator failed for ([127.0.0.1]) [182.60.3.136]:41637: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.161.134
description:
Jan 30 07:05:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 07:06:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.60.3.136
description:
Jan 30 07:05:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.60.3.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.161.134
description:
2025-01-30 07:05:23 dovecot_login authenticator failed for ([127.0.0.1]) [90.189.161.134]:40750: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-30 07:06:45 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:43630: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.214.3
description:
[2025-01-30 07:06:12 +0100] info [webmaild] 168.232.214.3 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.146.126
description:
Jan 30 07:06:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.146.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-30 07:06:50 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:56808: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.112.10
description:
[2025-01-30 07:07:04 +0100] info [webmaild] 213.230.112.10 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.240.244.17
description:
[2025-01-30 07:06:12 +0100] info [webmaild] 201.240.244.17 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.146.126
description:
2025-01-30 07:06:28 dovecot_plain authenticator failed for ([27.45.146.126]) [27.45.146.126]:36487: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 30 07:06:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Jan 30 07:06:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-01-30 07:06:37 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:63236: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 30 07:06:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 30 07:08:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.249.179
description:
2025-01-30 07:09:02 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.249.179]:33646: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.193.78
description:
2025-01-30 07:08:11 dovecot_plain authenticator failed for ([121.188.193.78]) [121.188.193.78]:50720: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Jan 30 07:08:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-01-30 07:08:24 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:54790: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Jan 30 07:08:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-01-30 07:08:30 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:36060: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 135.148.105.7
description:
Jan 30 07:08:32 ait sshd[735473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.148.105.7  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-30 07:08:52 dovecot_plain authenticator failed for (200-205-22-25.customer.tdatabrasil.net.br) [186.200.158.42]:34609: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.249.179
description:
Jan 30 07:09:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.249.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.71.6.31
description:
Jan 30 07:09:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.71.6.31 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.39.228.176
description:
[2025-01-30 07:09:15 +0100] info [webmaild] 46.39.228.176 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 07:09:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.6.31
description:
2025-01-30 07:09:13 dovecot_login authenticator failed for ([127.0.0.1]) [178.71.6.31]:43293: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 30 07:09:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-30 07:09:45 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:35313: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Jan 30 07:09:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.178.97
description:
[2025-01-30 07:10:04 +0100] info [webmaild] 168.196.178.97 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-01-30 07:09:33 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:46922: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
description:
Jan 30 07:10:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
description:
2025-01-30 07:10:12 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:48916: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.125.92
description:
[2025-01-30 07:10:27 +0100] info [webmaild] 186.235.125.92 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.113.32.149
description:
[2025-01-30 07:11:05 +0100] info [webmaild] 196.113.32.149 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 30 07:10:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-30 07:10:21 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:38736: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.242.102.131
domain: a-rapp.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-10.195.242.102.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.98.235
description:
[2025-01-30 07:11:07 +0100] info [webmaild] 170.239.98.235 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-30 07:11:28 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:59600: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-01-30 07:11:10 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:59070: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:11:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 30 07:11:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Jan 30 07:11:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.102.207.89
description:
[2025-01-30 07:12:59 +0100] info [webmaild] 177.102.207.89 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Jan 30 07:13:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 30 07:13:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-01-30 07:13:32 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:40974: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Jan 30 07:13:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
description:
Jan 30 07:13:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-01-30 07:13:40 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:42769: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.180.171.33
description:
[2025-01-30 07:13:45 +0100] info [webmaild] 187.180.171.33 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-01-30 07:13:12 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:36342: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-30 07:13:16 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:48888: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 07:14:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
description:
2025-01-30 07:14:31 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:52980: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.237.90
description:
2025-01-30 07:14:35 dovecot_plain authenticator failed for (187-50-193-126.customer.tdatabrasil.net.br) [201.28.237.90]:47838: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 07:14:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.244.231.239
description:
Jan 30 07:15:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.244.231.239 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.3.81
description:
[2025-01-30 07:14:18 +0100] info [webmaild] 45.167.3.81 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
description:
Jan 30 07:14:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
description:
Jan 30 07:14:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
description:
2025-01-30 07:14:41 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:59578: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:15:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.155.146
description:
Jan 30 07:15:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.238.90
description:
2025-01-30 07:15:45 dovecot_plain authenticator failed for ([122.187.147.17]) [128.185.238.90]:45126: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-30 07:16:07 dovecot_plain authenticator failed for (noeman) [65.20.183.209]:45788: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-01-30 07:15:12 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:35328: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


