# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
description:
2025-01-31 06:33:17 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:40138: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 06:33:29 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
description:
Jan 31 06:32:58 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 31 06:33:21 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
description:
Jan 31 06:34:20 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 31 06:34:21 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-01-31 06:33:48 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:47472: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-31 06:34:06 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:37892: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 31 06:33:42 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 31 06:34:04 ait sshd[1385791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 31 06:34:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.45.246.105
description:
[2025-01-31 06:34:16 +0100] info [webmaild] 38.45.246.105 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 31 06:34:04 ait sshd[1385791]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 31 06:34:03 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-31 06:34:16 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:10032: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
description:
2025-01-31 06:33:37 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:58748: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Jan 31 06:33:46 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
description:
Jan 31 06:33:35 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-31 06:33:44 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:20202: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-31 06:34:02 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:51636: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-31 06:34:05 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:47494: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.114.254.10
description:
[2025-01-31 06:34:12 +0100] info [webmaild] 103.114.254.10 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
description:
2025-01-31 06:34:22 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:47806: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 31 06:34:00 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 31 06:34:04 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-31 06:34:23 dovecot_plain authenticator failed for ([91.234.132.226]) [91.234.132.226]:53646: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Jan 31 06:34:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.137.248
description:
2025-01-31 06:34:42 dovecot_plain authenticator failed for ([60.191.137.248]) [60.191.137.248]:48818: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-01-31 06:34:32 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:43009: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.113.87
description:
2025-01-31 06:35:01 dovecot_plain authenticator failed for (padvited) [151.237.113.87]:47770: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-31 06:35:04 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (wavarlic) [176.37.212.85]:39777: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.216.249
description:
2025-01-31 06:35:16 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.216.249]:55268: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Jan 31 06:35:02 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.249.179
description:
Jan 31 06:35:31 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.249.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.137.248
description:
Jan 31 06:34:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.137.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 06:34:42 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.113.87
description:
Jan 31 06:34:59 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.113.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.156.19.235
description:
[2025-01-31 06:35:02 +0100] info [webmaild] 102.156.19.235 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.216.249
description:
Jan 31 06:35:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.216.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.224
description:
Jan 31 06:35:31 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.224
description:
2025-01-31 06:35:33 dovecot_plain authenticator failed for 110-25-105-224.adsl.fetnet.net [110.25.105.224]:49377: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Jan 31 06:35:34 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-01-31 06:35:36 dovecot_login authenticator failed for ([127.0.0.1]) [77.235.25.35]:60598: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.78
description:
Jan 31 06:35:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.78
description:
2025-01-31 06:35:47 dovecot_plain authenticator failed for ([122.187.246.78]) [122.187.246.78]:46632: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 31 06:36:27 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-31 06:36:29 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:34668: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.249.179
description:
2025-01-31 06:35:33 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.249.179]:44282: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 31 06:36:44 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-31 06:36:46 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:57586: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.111.201.10
description:
[2025-01-31 06:37:08 +0100] info [webmaild] 37.111.201.10 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 06:36:44 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.167.232.73
description:
[2025-01-31 06:37:50 +0100] info [webmaild] 103.167.232.73 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.134
description:
2025-01-31 06:37:57 dovecot_plain authenticator failed for ([218.149.228.134]) [218.149.228.134]:34520: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-31 06:38:13 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:42510: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Jan 31 06:38:13 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-01-31 06:38:15 dovecot_plain authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:34103: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
description:
Jan 31 06:38:18 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.134
description:
Jan 31 06:37:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.174.132
description:
2025-01-31 06:38:16 dovecot_plain authenticator failed for ([111.26.174.132]) [111.26.174.132]:40948: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
description:
Jan 31 06:37:32 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.24.212
description:
[2025-01-31 06:37:51 +0100] info [webmaild] 102.219.24.212 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.174.132
description:
Jan 31 06:38:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.174.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
description:
2025-01-31 06:38:20 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:56482: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
description:
2025-01-31 06:37:34 dovecot_plain authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:56660: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 31 06:38:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
description:
Jan 31 06:38:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
description:
2025-01-31 06:38:28 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:54634: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.196.74.163
description:
[2025-01-31 06:38:38 +0100] info [webmaild] 38.196.74.163 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.75.104.218
description:
Jan 31 06:38:46 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.75.104.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-01-31 06:38:34 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:46949: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.244
description:
Jan 31 06:38:35 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.244
description:
2025-01-31 06:38:37 dovecot_plain authenticator failed for ([123.214.65.244]) [123.214.65.244]:33172: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.104.218
description:
2025-01-31 06:38:48 dovecot_plain authenticator failed for ([91.75.104.218]) [91.75.104.218]:60987: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-38.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 06:39:05 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Jan 31 06:38:32 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 31 06:39:56 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 06:39:58 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-31 06:39:58 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:33972: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 31 06:40:15 ait sshd[1387913]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 31 06:40:15 ait sshd[1387913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Jan 31 06:39:36 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-01-31 06:39:38 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:56110: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Jan 31 06:40:32 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 31 06:41:00 ait sshd[1388056]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.136
description:
Jan 31 06:40:48 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 31 06:40:56 ait sshd[1388053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 31 06:41:00 ait sshd[1388056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-01-31 06:40:34 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:49146: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 31 06:40:56 ait sshd[1388053]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
description:
2025-01-31 06:41:24 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:51948: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
description:
2025-01-31 06:40:50 dovecot_plain authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:65302: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.35.64.212
description:
[2025-01-31 06:41:06 +0100] info [webmaild] 177.35.64.212 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
description:
Jan 31 06:41:22 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.111.113
description:
[2025-01-31 06:41:27 +0100] info [webmaild] 157.100.111.113 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Jan 31 06:42:00 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-01-31 06:41:40 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:54446: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.197.154.21
description:
[2025-01-31 06:41:49 +0100] info [webmaild] 103.197.154.21 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.39.94
description:
[2025-01-31 06:42:15 +0100] info [webmaild] 177.37.39.94 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.188.226
description:
Jan 31 06:42:25 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.188.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.188.226
description:
2025-01-31 06:42:27 dovecot_plain authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:43366: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Jan 31 06:41:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Jan 31 06:42:20 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-01-31 06:42:02 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:40678: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 31 06:42:13 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-31 06:42:15 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:26565: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-01-31 06:42:22 dovecot_plain authenticator failed for ([189.56.191.126]) [189.44.133.238]:38186: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 129.213.196.213
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-42.129.213.196.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 31 06:42:39 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-31 06:42:41 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:36574: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 31 06:42:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 31 06:43:29 ait sshd[1389135]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 31 06:43:29 ait sshd[1389135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-31 06:42:47 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:12818: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.15.178.174
description:
Jan 31 06:43:58 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.15.178.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.178.174
description:
2025-01-31 06:44:00 dovecot_plain authenticator failed for ([60.15.178.174]) [60.15.178.174]:44967: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Jan 31 06:44:10 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.142
description:
Jan 31 06:44:24 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.142
description:
2025-01-31 06:44:26 dovecot_plain authenticator failed for ([61.185.226.142]) [61.185.226.142]:43800: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.151.65.155
description:
Jan 31 06:43:31 ait sshd[1389135]: Failed password for invalid user admission from 82.151.65.155 port 46768 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 06:43:44 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Jan 31 06:43:53 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-01-31 06:43:55 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:41334: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-01-31 06:44:12 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:55668: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.209.201.220
description:
[2025-01-31 06:44:42 +0100] info [webmaild] 186.209.201.220 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.152.62
description:
[2025-01-31 06:45:01 +0100] info [webmaild] 179.189.152.62 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Jan 31 06:45:06 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-01-31 06:45:08 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:59464: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.125.34
description:
Jan 31 06:45:22 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.125.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.51.142.69
description:
[2025-01-31 06:45:26 +0100] info [webmaild] 179.51.142.69 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.125.34
description:
2025-01-31 06:45:24 dovecot_plain authenticator failed for ([182.176.125.34]) [182.176.125.34]:46136: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
description:
Jan 31 06:46:12 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-01-31 06:46:14 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:43027: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 31 06:46:24 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-31 06:46:06 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:49662: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 31 06:46:22 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 31 06:45:57 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-31 06:46:26 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:12819: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.204.82
description:
[2025-01-31 06:45:48 +0100] info [webmaild] 45.163.204.82 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-31 06:45:59 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:53835: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-31 06:46:24 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:22445: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 06:45:42 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 31 06:46:04 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Jan 31 06:47:05 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
description:
2025-01-31 06:47:07 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:43730: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-01-31 06:47:07 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:34465: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-01-31 06:46:41 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:56548: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
description:
Jan 31 06:47:05 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.58.130
description:
Jan 31 06:46:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.58.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 31 06:46:32 ait sshd[1390550]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 31 06:46:32 ait sshd[1390550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Jan 31 06:46:39 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.130
description:
2025-01-31 06:46:42 dovecot_plain authenticator failed for ([45.71.58.130]) [45.71.58.130]:34828: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.154.53.221
description:
Jan 31 06:46:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.154.53.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.154.53.221
description:
2025-01-31 06:46:57 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:29076: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 31 06:47:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.220.155
description:
Jan 31 06:47:51 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.217.145
description:
[2025-01-31 06:48:28 +0100] info [webmaild] 189.28.217.145 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.69.216.249
description:
Jan 31 06:47:37 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.69.216.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.216.249
description:
2025-01-31 06:47:39 dovecot_login authenticator failed for ([127.0.0.1]) [178.69.216.249]:60392: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Jan 31 06:47:44 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 31 06:48:00 ait sshd[1390666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 31 06:48:00 ait sshd[1390666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
description:
2025-01-31 06:48:03 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:44026: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-01-31 06:47:46 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:47268: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.220.155
description:
2025-01-31 06:47:53 dovecot_login authenticator failed for ([127.0.0.1]) [5.142.220.155]:56225: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
description:
Jan 31 06:48:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.40.149
description:
[2025-01-31 06:48:37 +0100] info [webmaild] 91.106.40.149 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-01-31 06:49:08 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:4985: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Jan 31 06:48:41 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.133
description:
Jan 31 06:48:50 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 31 06:48:52 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-01-31 06:48:43 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:40430: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.203.155.43
description:
[2025-01-31 06:49:24 +0100] info [webmaild] 185.203.155.43 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.133
description:
2025-01-31 06:48:52 dovecot_plain authenticator failed for ([121.11.145.133]) [121.11.145.133]:33680: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-31 06:48:54 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:48742: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Jan 31 06:49:06 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.61.198
description:
[2025-01-31 06:49:10 +0100] info [webmaild] 190.89.61.198 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-01-31 06:50:17 dovecot_login authenticator failed for ([218.25.233.2]) [218.25.233.22]:40066: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
description:
2025-01-31 06:50:24 dovecot_plain authenticator failed for ([220.172.203.43]) [220.172.203.43]:52267: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 31 06:50:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.30.162.58
description:
2025-01-31 06:50:14 dovecot_plain authenticator failed for ([60.30.162.58]) [60.30.162.58]:60040: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.186.253
description:
Jan 31 06:50:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.186.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
description:
2025-01-31 06:50:15 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:53362: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-31 06:50:28 dovecot_login authenticator failed for ([41.63.165.61]) [41.63.165.61]:62169: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Jan 31 06:50:29 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
description:
Jan 31 06:50:13 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.30.162.58
description:
Jan 31 06:50:12 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.30.162.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
description:
2025-01-31 06:50:16 dovecot_login authenticator failed for ([222.67.186.253]) [222.67.186.253]:52966: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.203.43
description:
Jan 31 06:50:22 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.203.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Jan 31 06:50:22 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-01-31 06:50:24 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:35903: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Jan 31 06:50:15 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Jan 31 06:50:35 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-01-31 06:50:58 dovecot_login authenticator failed for ([60.172.53.82]) [60.172.53.82]:36296: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 31 06:50:34 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
description:
Jan 31 06:50:51 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-31 06:51:03 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:38991: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
description:
2025-01-31 06:50:31 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:60394: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 31 06:51:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-01-31 06:50:37 dovecot_login authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:52339: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
description:
2025-01-31 06:50:53 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:54084: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Jan 31 06:50:56 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 31 06:51:15 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-31 06:51:17 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:45375: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-31 06:50:36 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:13245: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
description:
2025-01-31 06:52:22 dovecot_plain authenticator failed for ([219.144.16.16]) [219.144.16.16]:56913: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Jan 31 06:51:49 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Jan 31 06:51:53 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.84.60
description:
Jan 31 06:52:05 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.84.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
description:
2025-01-31 06:52:07 dovecot_plain authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:39760: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-01-31 06:51:51 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:35461: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.60.82
description:
Jan 31 06:52:04 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.60.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-01-31 06:52:10 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:37418: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-01-31 06:51:55 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:47419: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.152.201
description:
[2025-01-31 06:52:01 +0100] info [webmaild] 45.183.152.201 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.60.82
description:
2025-01-31 06:52:06 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:37054: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Jan 31 06:52:08 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.251.65.98
description:
[2025-01-31 06:52:11 +0100] info [webmaild] 154.251.65.98 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 06:52:18 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-51.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
description:
Jan 31 06:52:20 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 31 06:53:27 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-31 06:53:29 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:38974: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-01-31 06:52:51 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:63302: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.38.234.179
description:
[2025-01-31 06:53:00 +0100] info [webmaild] 189.38.234.179 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-31 06:53:28 dovecot_login authenticator failed for ([223.75.231.193]) [58.49.113.138]:12477: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
description:
Jan 31 06:52:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Jan 31 06:52:49 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-31 06:53:19 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:46265: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.98.49.198
description:
[2025-01-31 06:52:46 +0100] info [webmaild] 179.98.49.198 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-01-31 06:52:40 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:44032: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 31 06:53:09 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-31 06:53:11 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:2174: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 31 06:53:17 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 31 06:53:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 31 06:53:41 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-31 06:53:43 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:59825: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.61
description:
Jan 31 06:53:46 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Jan 31 06:53:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.120.237.37
description:
Jan 31 06:54:08 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.120.237.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-31 06:54:09 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:50370: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.61
description:
2025-01-31 06:53:48 dovecot_login authenticator failed for ([183.220.243.61]) [183.220.243.61]:53598: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-01-31 06:53:57 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:43698: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 31 06:54:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 31 06:54:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.67.5.146
description:
Jan 31 06:54:56 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.67.5.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Jan 31 06:55:08 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Jan 31 06:55:18 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 31 06:54:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-31 06:54:42 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:59718: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-31 06:55:01 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:8489: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-01-31 06:55:10 dovecot_plain authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:39738: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.67.5.146
description:
2025-01-31 06:54:58 dovecot_plain authenticator failed for ([183.67.5.146]) [183.67.5.146]:39885: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 31 06:54:59 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-31 06:54:42 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:59622: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-01-31 06:55:20 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:58601: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
description:
Jan 31 06:56:09 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 31 06:56:29 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.30.38.95
description:
[2025-01-31 06:55:45 +0100] info [webmaild] 191.30.38.95 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-31 06:56:03 dovecot_plain authenticator failed for ([222.161.242.146]) [222.161.242.146]:7649: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
description:
2025-01-31 06:56:11 dovecot_plain authenticator failed for ([60.14.36.47]) [60.14.36.47]:46848: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.201.8
description:
[2025-01-31 06:56:22 +0100] info [webmaild] 168.228.201.8 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 06:56:23 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 31 06:56:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.138.191.139
description:
[2025-01-31 06:56:37 +0100] info [webmaild] 177.138.191.139 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-31 06:56:59 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:40414: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.83
description:
2025-01-31 06:57:09 dovecot_plain authenticator failed for 083.42.246.220.static.netvigator.com [220.246.42.83]:64428: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.218
description:
2025-01-31 06:57:28 dovecot_login authenticator failed for (ADMIN) [212.102.49.218]:34558: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 31 06:56:32 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
description:
2025-01-31 06:56:43 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:46621: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-01-31 06:56:45 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:40638: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-31 06:56:31 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:45732: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-31 06:56:34 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:40322: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
description:
Jan 31 06:56:41 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Jan 31 06:56:43 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.90.182
description:
2025-01-31 06:56:54 dovecot_plain authenticator failed for ([175.156.90.182]) [175.156.90.182]:50551: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.83
description:
Jan 31 06:57:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.90.182
description:
Jan 31 06:56:52 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.90.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 31 06:56:57 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.180.36
description:
[2025-01-31 06:57:14 +0100] info [webmaild] 187.84.180.36 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 06:57:28 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-01-31 06:58:16 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:46657: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 06:58:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 31 06:57:37 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 31 06:57:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-31 06:57:42 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:34134: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Jan 31 06:57:48 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Jan 31 06:57:55 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-01-31 06:57:57 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:52641: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-31 06:57:39 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:20247: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-01-31 06:57:50 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:50220: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Jan 31 06:58:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.77.122
description:
Jan 31 06:58:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.129.77.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.118.173.234
description:
Jan 31 06:58:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.118.173.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.173.234
description:
2025-01-31 06:58:47 dovecot_plain authenticator failed for ([220.118.173.234]) [220.118.173.234]:45992: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Jan 31 06:59:00 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
description:
Jan 31 06:59:22 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 06:58:49 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Jan 31 06:58:51 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-01-31 06:58:53 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:38712: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Jan 31 06:59:12 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-31 06:59:14 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:57036: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-59.157.230.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.129.77.122
description:
2025-01-31 06:58:32 dovecot_plain authenticator failed for ([125.129.77.122]) [125.129.77.122]:54170: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.42.104.163
description:
Jan 31 06:59:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.42.104.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-01-31 06:59:02 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:58613: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.42.104.163
description:
2025-01-31 06:59:03 dovecot_plain authenticator failed for ([212.42.104.163]) [212.42.104.163]:51862: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.77.111
description:
[2025-01-31 06:59:24 +0100] info [webmaild] 177.221.77.111 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
description:
2025-01-31 06:59:24 dovecot_plain authenticator failed for ([39.88.252.16]) [39.88.252.16]:40092: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 31 07:00:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-01-31 07:00:13 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:49588: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.16.230
description:
Jan 31 07:00:25 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.16.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.16.230
description:
2025-01-31 07:00:27 dovecot_plain authenticator failed for 111-70-16-230.emome-ip.hinet.net [111.70.16.230]:57489: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 143.198.188.191
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-59.143.198.188.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.155
description:
Jan 31 06:59:39 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.155
description:
2025-01-31 06:59:41 dovecot_plain authenticator failed for ([166.195.195.155]) [166.195.195.155]:56693: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.246.185.244
description:
[2025-01-31 07:00:14 +0100] info [webmaild] 190.246.185.244 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-31 07:00:09 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:12820: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.33.206.122
description:
[2025-01-31 07:00:10 +0100] info [webmaild] 187.33.206.122 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Jan 31 07:00:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.81.95
description:
2025-01-31 07:02:02 dovecot_plain authenticator failed for ([118.200.81.95]) [118.200.81.95]:47156: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
description:
Jan 31 07:02:10 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
description:
2025-01-31 07:02:12 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:54480: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-31 07:03:27 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:49194: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.49.147.12
description:
[2025-01-31 07:02:53 +0100] info [webmaild] 39.49.147.12 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 31 07:03:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.178.225
description:
[2025-01-31 07:03:47 +0100] info [webmaild] 181.116.178.225 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.111.139.88
description:
2025-01-31 07:04:07 dovecot_plain authenticator failed for pool-98-111-139-88.phlapa.fios.verizon.net [98.111.139.88]:38360: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.111.139.88
description:
Jan 31 07:04:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.111.139.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-01-31 07:03:52 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:35818: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Jan 31 07:03:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.197.154.0
description:
[2025-01-31 07:03:43 +0100] info [webmaild] 103.197.154.0 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-01-31 07:03:38 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:44650: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Jan 31 07:03:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-31 07:04:50 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:54924: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-31 07:04:59 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:35273: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
description:
Jan 31 07:05:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-31 07:05:19 dovecot_plain authenticator failed for (undess) [164.92.243.206]:46498: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-04.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.96.33.56
description:
[2025-01-31 07:04:34 +0100] info [webmaild] 102.96.33.56 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 31 07:04:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-01-31 07:05:07 dovecot_login authenticator failed for ([127.0.0.1]) [102.215.188.37]:37365: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 31 07:05:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.145.238
description:
2025-01-31 07:05:16 dovecot_login authenticator failed for ([127.0.0.1]) [171.237.145.238]:36224: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 31 07:04:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.237.145.238
description:
Jan 31 07:05:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.237.145.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
description:
2025-01-31 07:05:24 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:48625: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 31 07:05:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-01-31 07:05:45 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:43666: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-31 07:06:00 dovecot_plain authenticator failed for ([182.43.160.124]) [203.34.57.78]:60682: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.61.57
description:
Jan 31 07:06:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.61.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.61.57
description:
2025-01-31 07:06:16 dovecot_plain authenticator failed for ([111.53.61.57]) [111.53.61.57]:58217: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-01-31 07:06:25 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:40554: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.49.223
description:
[2025-01-31 07:06:30 +0100] info [webmaild] 131.72.49.223 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-01-31 07:05:39 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:46729: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.118
description:
47.128.40.118 - - [31/Jan/2025:07:05:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26434449 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/4/?duration=short%2Cmedium%2Clong&filtering=1&level=intermediate%2Cbeginner%2Cexpert&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-31 07:06:48 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:15593: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-31 07:07:07 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:34653: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.15.58.89
description:
[2025-01-31 07:07:23 +0100] info [webmaild] 157.15.58.89 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.11.119
description:
2025-01-31 07:06:35 dovecot_login authenticator failed for ([127.0.0.1]) [122.175.11.119]:47812: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-31 07:06:45 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:34804: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.75.42
description:
Jan 31 07:06:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.75.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 31 07:07:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 31 07:07:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 31 07:06:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
description:
2025-01-31 07:06:53 dovecot_plain authenticator failed for ([180.94.75.42]) [180.94.75.42]:51544: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-31 07:07:24 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:59846: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 31 07:06:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 31 07:07:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-31 07:07:06 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:50809: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Jan 31 07:07:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-01-31 07:07:12 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:51768: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.24.52
description:
[2025-01-31 07:08:26 +0100] info [webmaild] 45.185.24.52 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-31 07:08:19 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:35510: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
description:
Jan 31 07:08:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-01-31 07:07:52 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:50172: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 203.162.166.162
domain: scholarship.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-07.203.162.166.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.107.113.42
description:
[2025-01-31 07:07:40 +0100] info [webmaild] 179.107.113.42 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Jan 31 07:07:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.121.0.66
description:
Jan 31 07:08:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.121.0.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.0.66
description:
2025-01-31 07:08:09 dovecot_plain authenticator failed for ([24.121.0.66]) [24.121.0.66]:53204: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 31 07:08:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
description:
2025-01-31 07:08:25 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:54425: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Jan 31 07:07:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-01-31 07:07:43 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:55134: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.242.102.131
domain: scholarship.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-07.195.242.102.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Jan 31 07:09:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
description:
Jan 31 07:08:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
description:
2025-01-31 07:08:41 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:54406: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.176.67
description:
2025-01-31 07:09:16 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.176.67]:38656: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-01-31 07:09:24 dovecot_login authenticator failed for ([127.0.0.1]) [203.172.213.166]:43932: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.118.173.234
description:
Jan 31 07:09:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.118.173.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.173.234
description:
2025-01-31 07:09:19 dovecot_plain authenticator failed for ([220.118.173.234]) [220.118.173.234]:39838: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.176.67
description:
Jan 31 07:09:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.157
description:
2025-01-31 07:09:31 dovecot_plain authenticator failed for ([220.180.171.157]) [220.180.171.157]:49603: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.126
description:
Jan 31 07:10:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.191.123.29
description:
[2025-01-31 07:10:08 +0100] info [webmaild] 103.191.123.29 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.126
description:
2025-01-31 07:10:10 dovecot_plain authenticator failed for ([222.170.255.126]) [222.170.255.126]:39424: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-01-31 07:09:56 dovecot_plain authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:58503: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
description:
Jan 31 07:10:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
description:
Jan 31 07:10:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 31 07:11:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
description:
2025-01-31 07:11:29 dovecot_plain authenticator failed for (90.188.40.123.stbur.ru) [90.188.40.123]:44834: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
description:
2025-01-31 07:10:34 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:59409: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.247.195
description:
2025-01-31 07:11:15 dovecot_plain authenticator failed for ([46.138.247.195]) [46.138.247.195]:54004: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 31 07:11:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.185.73
description:
[2025-01-31 07:11:06 +0100] info [webmaild] 131.221.185.73 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-31 07:11:07 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:49012: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.247.195
description:
Jan 31 07:11:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.247.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Jan 31 07:11:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-01-31 07:11:22 dovecot_plain authenticator failed for ([160.72.153.14]) [160.72.153.14]:39675: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
description:
2025-01-31 07:10:50 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:44032: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.242.110.198
description:
[2025-01-31 07:10:56 +0100] info [webmaild] 188.242.110.198 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-01-31 07:12:29 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:37276: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Jan 31 07:11:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-01-31 07:11:45 dovecot_login authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:51940: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-01-31 07:12:02 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:55302: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-31 07:11:31 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:37271: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.15.251.33
description:
2025-01-31 07:11:33 dovecot_login authenticator failed for ([59.15.251.33]) [59.15.251.33]:47804: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
description:
2025-01-31 07:12:11 dovecot_plain authenticator failed for ([5.130.173.74]) [5.130.173.74]:57356: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.72.89.67
description:
2025-01-31 07:11:36 dovecot_plain authenticator failed for 211-72-89-67.hinet-ip.hinet.net [211.72.89.67]:40135: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 31 07:12:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
description:
2025-01-31 07:12:06 dovecot_plain authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:38626: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
description:
Jan 31 07:11:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
description:
Jan 31 07:11:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
description:
Jan 31 07:12:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-31 07:12:16 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:2559: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 31 07:12:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
description:
2025-01-31 07:11:51 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:52530: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Jan 31 07:12:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
description:
Jan 31 07:11:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
description:
2025-01-31 07:11:52 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:35939: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-01-31 07:11:52 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:51716: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-31 07:12:12 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:34303: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.72.89.67
description:
Jan 31 07:11:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.72.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
description:
2025-01-31 07:11:40 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:58262: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 31 07:12:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-31 07:12:22 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:51350: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Jan 31 07:12:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Jan 31 07:11:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.181.197.135
description:
[2025-01-31 07:11:54 +0100] info [webmaild] 182.181.197.135 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-01-31 07:12:46 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:42845: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.137.248
description:
Jan 31 07:13:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.137.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-01-31 07:12:34 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:48758: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.137.248
description:
2025-01-31 07:13:02 dovecot_plain authenticator failed for ([60.191.137.248]) [60.191.137.248]:56574: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-01-31 07:13:20 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:45489: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Jan 31 07:12:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 31 07:12:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Jan 31 07:12:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-31 07:12:32 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:49670: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
description:
2025-01-31 07:12:36 dovecot_plain authenticator failed for ([189.113.43.174]) [189.113.43.174]:60688: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
description:
2025-01-31 07:12:42 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:51192: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Jan 31 07:13:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Jan 31 07:13:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-01-31 07:13:44 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:33287: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
description:
Jan 31 07:13:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
description:
2025-01-31 07:13:58 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:38204: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-31 07:14:03 dovecot_plain authenticator failed for ([60.213.27.250]) [60.213.27.250]:55636: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.134.21.98
description:
[2025-01-31 07:13:40 +0100] info [webmaild] 2.134.21.98 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-31 07:13:46 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:46391: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 31 07:14:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 31 07:13:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.170.139
description:
[2025-01-31 07:14:32 +0100] info [webmaild] 191.37.170.139 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.187.31
description:
2025-01-31 07:15:13 dovecot_plain authenticator failed for (abts-north-static-031.187.160.122.airtelbroadband.in) [122.160.187.31]:56131: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 07:15:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Jan 31 07:15:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-01-31 07:15:29 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:42450: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.95.69.71
description:
[2025-01-31 07:14:47 +0100] info [webmaild] 197.95.69.71 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 31 07:15:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-31 07:15:03 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:56432: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.187.31
description:
Jan 31 07:15:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.187.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.175.201.58
description:
2025-01-31 07:15:20 dovecot_plain authenticator failed for ([59.175.201.58]) [59.175.201.58]:39258: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-31 07:15:42 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:59006: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.194.9.65
description:
Jan 31 07:15:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.194.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-01-31 07:16:04 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:35776: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.112.2
description:
[2025-01-31 07:15:32 +0100] info [webmaild] 170.83.112.2 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-16.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.20.228.20
description:
Jan 31 07:16:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.20.228.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 31 07:15:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Jan 31 07:16:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
description:
2025-01-31 07:16:23 dovecot_plain authenticator failed for ([157.20.228.20]) [157.20.228.20]:59832: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.194.9.65
description:
2025-01-31 07:15:53 dovecot_plain authenticator failed for syn-024-194-009-065.res.spectrum.com [24.194.9.65]:49335: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Jan 31 07:17:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-17.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 31 07:16:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 31 07:16:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.18.185.69
description:
[2025-01-31 07:17:13 +0100] info [webmaild] 177.18.185.69 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-31 07:16:40 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:56536: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-31 07:16:55 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:35252: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-01-31 07:17:21 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:45373: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-01-31 07:17:34 dovecot_plain authenticator failed for ([201.172.170.49]) [201.172.170.49]:38646: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.192.214
description:
[2025-01-31 07:18:03 +0100] info [webmaild] 198.163.192.214 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Jan 31 07:17:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.126.86
description:
47.128.126.86 - - [31/Jan/2025:07:17:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15688056 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C61&filter_course-language=99%2C183%2C95%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.126.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 07:18:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.31.27.217
description:
[2025-01-31 07:18:23 +0100] info [webmaild] 46.31.27.217 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
description:
2025-01-31 07:18:49 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:61039: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.168.65.150
description:
Jan 31 07:19:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.168.65.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.168.65.150
description:
2025-01-31 07:19:13 dovecot_login authenticator failed for ([127.0.0.1]) [217.168.65.150]:60532: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 31 07:19:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-31 07:19:26 dovecot_plain authenticator failed for ([60.8.50.150]) [60.8.50.150]:60604: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
description:
2025-01-31 07:19:28 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:53734: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.23.14
description:
47.128.23.14 - - [31/Jan/2025:07:18:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15533115 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/11/?duration=short%2Cmedium&level=intermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.23.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
description:
Jan 31 07:18:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-31 07:19:10 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:52177: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-01-31 07:18:32 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:37918: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.214.84
description:
Jan 31 07:18:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.214.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.214.84
description:
2025-01-31 07:19:01 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.214.84]:35378: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 31 07:19:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
description:
2025-01-31 07:18:58 dovecot_login authenticator failed for ([127.0.0.1]) [58.252.222.82]:44438: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.194.189.56
description:
[2025-01-31 07:19:08 +0100] info [webmaild] 189.194.189.56 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
description:
Jan 31 07:19:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 31 07:19:35 ait sshd[1403936]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 31 07:19:35 ait sshd[1403936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-31 07:19:40 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:60449: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
description:
2025-01-31 07:19:52 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:51090: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 31 07:19:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-31 07:19:37 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:29409: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-31 07:20:03 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:41838: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.158.48
description:
[2025-01-31 07:20:42 +0100] info [webmaild] 45.182.158.48 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.228.190.124
description:
Jan 31 07:20:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.228.190.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.171
description:
Jan 31 07:21:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.230
description:
2025-01-31 07:21:18 dovecot_plain authenticator failed for ([27.40.100.230]) [27.40.100.230]:35162: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.230
description:
Jan 31 07:21:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Jan 31 07:21:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-01-31 07:21:30 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:44690: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
description:
2025-01-31 07:20:59 dovecot_plain authenticator failed for 45-228-190-124.obercom.net.ar [45.228.190.124]:48272: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.171
description:
2025-01-31 07:21:13 dovecot_plain authenticator failed for 111-70-21-171.emome-ip.hinet.net [111.70.21.171]:48711: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.48.170
description:
47.128.48.170 - - [31/Jan/2025:07:21:14 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28630736 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=79%2C120%2C183%2C99&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.48.170


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
description:
2025-01-31 07:22:02 dovecot_plain authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:42158: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
description:
2025-01-31 07:22:14 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:36141: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.78.95.147
description:
[2025-01-31 07:21:32 +0100] info [webmaild] 105.78.95.147 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Jan 31 07:22:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.142.88.181
description:
[2025-01-31 07:22:00 +0100] info [cpaneld] 41.142.88.181 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.67
description:
[2025-01-31 07:22:01 +0100] info [webmaild] 84.54.72.67 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-01-31 07:22:42 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:48807: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.239.50.133
description:
[2025-01-31 07:22:48 +0100] info [webmaild] 45.239.50.133 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 31 07:23:12 ait sshd[1405347]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 31 07:23:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 31 07:23:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-31 07:23:25 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:49753: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-31 07:23:28 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:28144: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 31 07:22:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-31 07:22:33 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:58530: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
description:
Jan 31 07:22:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 31 07:23:12 ait sshd[1405347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
description:
2025-01-31 07:24:17 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:54239: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Jan 31 07:24:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
description:
2025-01-31 07:23:37 dovecot_plain authenticator failed for ([188.43.245.90]) [188.43.232.65]:39008: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-31 07:23:37 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:45494: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-31 07:23:41 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (namic) [91.56.31.167]:62294: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
description:
2025-01-31 07:23:59 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:42781: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-01-31 07:24:12 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:62619: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
description:
Jan 31 07:24:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-01-31 07:24:28 dovecot_plain authenticator failed for ([194.53.179.161]) [194.53.179.161]:41201: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
description:
Jan 31 07:23:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Jan 31 07:24:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-01-31 07:24:46 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:49206: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 07:24:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
description:
2025-01-31 07:24:35 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:57573: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.1.249.135
description:
[2025-01-31 07:24:39 +0100] info [webmaild] 169.1.249.135 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
description:
Jan 31 07:24:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.234.31
description:
[2025-01-31 07:25:30 +0100] info [webmaild] 179.108.234.31 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-25.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 31 07:25:54 ait sshd[1406568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.42.9.70
description:
[2025-01-31 07:26:19 +0100] info [webmaild] 92.42.9.70 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.123.153.249
description:
[2025-01-31 07:26:26 +0100] info [cpaneld] 206.123.153.249 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-01-31 07:26:26 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:53268: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 31 07:26:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 07:25:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 172.94.110.242
description:
[2025-01-31 07:26:27 +0100] info [cpaneld] 172.94.110.242 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-31 07:26:30 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:32942: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.164.114
description:
[2025-01-31 07:25:33 +0100] info [webmaild] 177.91.164.114 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 31 07:25:54 ait sshd[1406568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Jan 31 07:26:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Jan 31 07:27:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 31 07:27:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.107
description:
2025-01-31 07:26:41 dovecot_plain authenticator failed for ([196.46.200.107]) [196.46.200.107]:52288: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.75
description:
2025-01-31 07:26:57 dovecot_plain authenticator failed for (nsg-corporate-75.230.187.122.airtel.in) [122.187.230.75]:35770: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-01-31 07:27:14 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:38886: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
description:
2025-01-31 07:26:38 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:55520: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-31 07:26:47 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:56588: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.75
description:
Jan 31 07:26:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.247.84
description:
Jan 31 07:27:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.247.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 31 07:27:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.226.218
description:
Jan 31 07:27:34 ait sshd[1406985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.226.218


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.241
description:
2025-01-31 07:27:45 dovecot_login authenticator failed for (ADMIN) [45.133.172.241]:50762: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.57.207.232
description:
[2025-01-31 07:28:16 +0100] info [webmaild] 2.57.207.232 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-01-31 07:27:43 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:57888: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-31 07:27:51 dovecot_plain authenticator failed for ([82.193.122.91]) [82.193.122.91]:41197: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
description:
2025-01-31 07:27:45 dovecot_plain authenticator failed for ([203.192.247.84]) [203.192.247.84]:38786: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-31 07:27:31 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:3870: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.90.226.218
description:
Jan 31 07:27:34 ait sshd[1406985]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.90.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.133.172.241
description:
Jan 31 07:27:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.133.172.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.61.191
description:
[2025-01-31 07:28:59 +0100] info [webmaild] 179.49.61.191 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-31 07:29:03 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (ropht) [51.255.84.180]:42664: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.124.251.181
description:
[2025-01-31 07:29:07 +0100] info [webmaild] 103.124.251.181 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 07:28:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 07:29:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-31 07:29:54 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:57858: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
description:
2025-01-31 07:30:09 dovecot_plain authenticator failed for ([61.184.176.231]) [61.184.176.231]:34995: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.51.208.170
description:
Jan 31 07:30:16 ait sshd[1408160]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.51.208.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.51.208.170
description:
Jan 31 07:30:16 ait sshd[1408160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.51.208.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.184.82
description:
[2025-01-31 07:29:46 +0100] info [webmaild] 45.171.184.82 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 07:30:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-30.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 07:31:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Jan 31 07:31:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-01-31 07:32:08 dovecot_plain authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:52215: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
description:
Jan 31 07:32:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-31 07:32:26 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:47293: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.240.221.173
description:
[2025-01-31 07:31:51 +0100] info [webmaild] 92.240.221.173 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
description:
Jan 31 07:31:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Jan 31 07:32:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 31 07:32:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
description:
2025-01-31 07:31:50 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:59398: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
description:
2025-01-31 07:32:00 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (ingorp) [5.228.154.62]:55246: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-01-31 07:32:00 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:45282: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
description:
2025-01-31 07:32:17 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:36730: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.42.119.81
description:
[2025-01-31 07:32:26 +0100] info [webmaild] 212.42.119.81 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Jan 31 07:33:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.51.208.170
description:
Jan 31 07:32:31 ait sshd[1409052]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.51.208.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 31 07:32:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.209.254.222
description:
[2025-01-31 07:32:40 +0100] info [webmaild] 186.209.254.222 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.254.174
description:
2025-01-31 07:33:00 dovecot_login authenticator failed for p98174-obmd01.tokyo.ocn.ne.jp ([127.0.0.1]) [124.101.254.174]:41887: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 31 07:33:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-01-31 07:33:25 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:37662: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.51.208.170
description:
Jan 31 07:32:31 ait sshd[1409052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.51.208.170


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-31 07:32:35 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:40835: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.254.174
description:
Jan 31 07:32:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.254.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.214.249
description:
[2025-01-31 07:33:14 +0100] info [webmaild] 45.172.214.249 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
description:
2025-01-31 07:33:09 dovecot_login authenticator failed for ([127.0.0.1]) [175.125.68.208]:57430: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-31 07:33:11 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:8018: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
description:
Jan 31 07:33:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.51.208.170
description:
Jan 31 07:33:58 ait sshd[1409407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.51.208.170  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 07:34:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Jan 31 07:34:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-01-31 07:34:12 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:50549: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.51.208.170
description:
Jan 31 07:33:58 ait sshd[1409407]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.51.208.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 31 07:33:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-31 07:33:54 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:53247: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.126
description:
Jan 31 07:34:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.126 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-34.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 31 07:34:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
description:
Jan 31 07:34:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-31 07:34:56 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:56680: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.204.214.84
description:
[2025-01-31 07:35:20 +0100] info [webmaild] 191.204.214.84 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.28.193.113
description:
Jan 31 07:34:43 ait sshd[1409789]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.28.193.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.28.193.113
description:
Jan 31 07:34:43 ait sshd[1409789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.28.193.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.126
description:
2025-01-31 07:34:43 dovecot_plain authenticator failed for ([222.170.255.126]) [222.170.255.126]:38979: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 07:34:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
description:
2025-01-31 07:34:56 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:51856: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
description:
Jan 31 07:34:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
description:
2025-01-31 07:34:46 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:42462: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
description:
2025-01-31 07:36:07 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:36785: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.71.237.251
description:
[2025-01-31 07:36:11 +0100] info [webmaild] 186.71.237.251 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-31 07:36:20 dovecot_plain authenticator failed for ([182.43.160.124]) [203.34.57.78]:33808: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-01-31 07:35:33 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:37674: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
description:
Jan 31 07:35:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-31 07:36:06 dovecot_plain authenticator failed for ([185.123.78.13]) [185.123.78.13]:11779: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Jan 31 07:35:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 31 07:36:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-01-31 07:35:45 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:33428: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
description:
2025-01-31 07:35:53 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:47658: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.163.158.18
description:
[2025-01-31 07:36:15 +0100] info [webmaild] 105.163.158.18 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
description:
Jan 31 07:35:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 31 07:36:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
description:
Jan 31 07:36:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 31 07:37:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-31 07:36:59 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:47708: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.237.217.249
description:
[2025-01-31 07:37:02 +0100] info [webmaild] 179.237.217.249 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
description:
Jan 31 07:37:13 ait sshd[1410794]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 31 07:36:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Jan 31 07:37:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
description:
Jan 31 07:37:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-01-31 07:37:24 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:59461: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-31 07:37:16 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:60250: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
description:
2025-01-31 07:37:11 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:55671: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
description:
Jan 31 07:37:13 ait sshd[1410794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-01-31 07:38:06 dovecot_plain authenticator failed for ([201.172.170.49]) [201.172.170.49]:49321: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-31 07:37:44 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:40478: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Jan 31 07:37:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-01-31 07:38:00 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:37590: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Jan 31 07:38:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.147.37
description:
Jan 31 07:37:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.147.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
description:
2025-01-31 07:37:54 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:56221: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Jan 31 07:38:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-01-31 07:38:22 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:58898: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 31 07:37:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.28.193.113
description:
Jan 31 07:37:43 ait sshd[1410866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.28.193.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.28.193.113
description:
Jan 31 07:37:43 ait sshd[1410866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.28.193.113


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.26.106.68
description:
[2025-01-31 07:38:47 +0100] info [webmaild] 95.26.106.68 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-01-31 07:38:48 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:48476: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Jan 31 07:39:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-01-31 07:39:14 dovecot_plain authenticator failed for ([200.205.223.1]) [187.93.153.166]:41499: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.173.82.198
description:
Jan 31 07:39:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.173.82.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 31 07:38:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Jan 31 07:38:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.82.198
description:
2025-01-31 07:39:23 dovecot_plain authenticator failed for ([222.173.82.198]) [222.173.82.198]:7888: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-31 07:38:36 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:45424: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-01-31 07:39:37 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:33636: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.165.29
description:
[2025-01-31 07:39:42 +0100] info [webmaild] 177.11.165.29 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 07:39:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.217.150.72
description:
Jan 31 07:39:54 ait sshd[1411685]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.217.150.72 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.217.150.72
description:
Jan 31 07:39:54 ait sshd[1411685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.217.150.72  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.28.193.113
description:
Jan 31 07:40:23 ait sshd[1412187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.28.193.113


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.237.122.125
description:
[2025-01-31 07:39:50 +0100] info [webmaild] 212.237.122.125 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.28.193.113
description:
Jan 31 07:40:23 ait sshd[1412187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.28.193.113 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.193.113
description:
Jan 31 07:40:25 ait sshd[1412187]: Failed password for invalid user misp from 120.28.193.113 port 34085 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Jan 31 07:39:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-40.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.252
description:
Jan 31 07:41:05 ait sshd[1412379]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.252
description:
Jan 31 07:41:05 ait sshd[1412379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.252  user=root


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.252
description:
Jan 31 07:41:27 ait sshd[1412379]: error: maximum authentication attempts exceeded for root from 218.92.0.252 port 11224 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.51.89.201
description:
[2025-01-31 07:40:37 +0100] info [webmaild] 202.51.89.201 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 112.134.216.105
description:
[2025-01-31 07:42:22 +0100] info [webmaild] 112.134.216.105 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-01-31 07:41:37 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:54022: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Jan 31 07:41:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-01-31 07:41:59 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:36772: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Jan 31 07:42:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-01-31 07:42:11 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:51200: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-01-31 07:42:12 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:41705: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 31 07:42:27 ait sshd[1412995]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Jan 31 07:41:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Jan 31 07:42:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 31 07:42:27 ait sshd[1412995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Jan 31 07:42:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.175
description:
2025-01-31 07:43:04 dovecot_plain authenticator failed for (nsg-corporate-175.229.187.122.airtel.in) [122.187.229.175]:49500: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-31 07:43:09 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:55876: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-01-31 07:43:30 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:59082: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
description:
Jan 31 07:43:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
description:
Jan 31 07:42:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-31 07:42:42 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:38644: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Jan 31 07:43:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 31 07:42:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
description:
2025-01-31 07:42:53 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:39821: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.30.24
description:
Jan 31 07:42:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.30.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Jan 31 07:42:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
description:
2025-01-31 07:43:13 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:56706: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.67.218
description:
Jan 31 07:43:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.67.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.58.49
description:
[2025-01-31 07:43:29 +0100] info [webmaild] 128.201.58.49 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.50.206
description:
Jan 31 07:42:30 ait sshd[1412995]: Failed password for invalid user admissions from 146.190.50.206 port 35110 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.10.20
description:
Jan 31 07:42:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.10.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-01-31 07:43:01 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:50432: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.105.93.136
description:
2025-01-31 07:43:07 dovecot_login authenticator failed for ([210.105.93.136]) [210.105.93.136]:53944: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.201.176
description:
[2025-01-31 07:43:13 +0100] info [webmaild] 45.228.201.176 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
description:
2025-01-31 07:42:33 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:33300: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.105.93.136
description:
Jan 31 07:43:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.105.93.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.175
description:
Jan 31 07:43:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.218
description:
2025-01-31 07:43:16 dovecot_login authenticator failed for ([103.58.67.218]) [103.58.67.218]:44990: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
description:
Jan 31 07:43:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
description:
2025-01-31 07:43:21 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:50003: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
description:
2025-01-31 07:42:50 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:54241: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 31 07:42:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-01-31 07:42:57 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:54018: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.30.24
description:
2025-01-31 07:43:00 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:50529: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 31 07:43:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-43.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.134
description:
Jan 31 07:43:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 07:43:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 07:44:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-01-31 07:44:30 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:59704: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.134
description:
2025-01-31 07:43:35 dovecot_plain authenticator failed for ([119.62.184.134]) [119.62.184.134]:48849: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.182.127
description:
[2025-01-31 07:44:14 +0100] info [webmaild] 177.128.182.127 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Jan 31 07:44:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-01-31 07:45:08 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:59345: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.253
description:
2025-01-31 07:44:41 dovecot_plain authenticator failed for 111-70-23-253.emome-ip.hinet.net [111.70.23.253]:36606: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Jan 31 07:45:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
description:
Jan 31 07:45:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 31 07:44:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-31 07:44:54 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:54204: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 07:45:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
description:
2025-01-31 07:45:20 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:34684: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.253
description:
Jan 31 07:44:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.16.115
description:
2025-01-31 07:45:56 dovecot_plain authenticator failed for playmail20191.fvds.ru [103.54.16.115]:51958: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 31 07:45:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-01-31 07:45:47 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:36941: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Jan 31 07:46:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-01-31 07:46:19 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:50794: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-45.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.42.207
description:
Jan 31 07:46:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.42.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 31 07:46:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-31 07:46:03 dovecot_plain authenticator failed for ([211.199.5.231]) [211.199.5.231]:35994: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 31 07:46:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
description:
Jan 31 07:46:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
description:
2025-01-31 07:45:36 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:59478: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
description:
2025-01-31 07:45:39 dovecot_plain authenticator failed for ([111.207.231.67]) [111.207.231.65]:34274: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-01-31 07:45:49 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:51528: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-31 07:46:03 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:43146: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 07:45:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.54.16.115
description:
Jan 31 07:45:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.54.16.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 31 07:46:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-31 07:46:16 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:55254: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
description:
Jan 31 07:46:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 31 07:46:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.33.137.161
description:
[2025-01-31 07:45:54 +0100] info [webmaild] 177.33.137.161 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
description:
2025-01-31 07:46:26 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:57800: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
description:
2025-01-31 07:46:27 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:50854: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Jan 31 07:45:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
description:
Jan 31 07:45:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
description:
Jan 31 07:45:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.42.207
description:
2025-01-31 07:46:02 dovecot_plain authenticator failed for p281208-obmd01.tokyo.ocn.ne.jp [153.141.42.207]:44385: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.86.114.43
description:
2025-01-31 07:46:40 dovecot_plain authenticator failed for (fumec.bhe.gvt.net.br) [201.86.114.43]:32942: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-31 07:47:19 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:59540: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-31 07:46:31 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:39160: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 31 07:46:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-31 07:46:34 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:53388: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 31 07:46:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-31 07:46:49 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:60802: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 07:46:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 31 07:47:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Jan 31 07:47:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.86.114.43
description:
Jan 31 07:46:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.86.114.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.208.40.203
description:
[2025-01-31 07:46:45 +0100] info [webmaild] 154.208.40.203 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 31 07:46:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
description:
2025-01-31 07:46:49 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:39177: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.68.11
description:
[2025-01-31 07:47:17 +0100] info [webmaild] 37.77.68.11 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 31 07:46:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-01-31 07:46:32 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:43311: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-01-31 07:47:29 dovecot_login authenticator failed for ([187.93.153.166]) [187.93.153.166]:55872: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-31 07:47:57 dovecot_login authenticator failed for ([1.245.207.104]) [1.245.207.104]:53741: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-01-31 07:48:07 dovecot_login authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:53140: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Jan 31 07:48:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-01-31 07:48:23 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net ([200.105.141.161]) [200.105.141.170]:36166: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.47.3.221
description:
2025-01-31 07:48:28 dovecot_login authenticator failed for ([14.47.3.221]) [14.47.3.221]:36748: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 31 07:47:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.214
description:
Jan 31 07:48:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-01-31 07:48:11 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:53324: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-31 07:48:13 dovecot_login authenticator failed for ([116.90.97.209]) [116.90.97.209]:56155: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-31 07:48:16 dovecot_login authenticator failed for ([1.224.58.243]) [1.224.58.243]:33250: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Jan 31 07:47:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-31 07:47:46 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:41526: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 31 07:48:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 31 07:47:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.214
description:
2025-01-31 07:48:03 dovecot_login authenticator failed for ([61.185.226.214]) [61.185.226.214]:37855: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Jan 31 07:48:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.47.3.221
description:
Jan 31 07:48:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.47.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-01-31 07:47:56 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:33078: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Jan 31 07:48:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 31 07:48:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Jan 31 07:48:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 31 07:47:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-31 07:48:05 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:55416: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 31 07:48:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.229.86
description:
Jan 31 07:48:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.229.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.229.86
description:
2025-01-31 07:48:26 dovecot_login authenticator failed for ([31.141.229.86]) [31.141.229.86]:59952: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
description:
Jan 31 07:48:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.153.223.191
description:
[2025-01-31 07:48:01 +0100] info [webmaild] 186.153.223.191 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-01-31 07:47:56 dovecot_login authenticator failed for ([203.189.124.2]) [203.189.124.2]:54819: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-01-31 07:48:19 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:44411: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-01-31 07:47:48 dovecot_login authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:53798: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Jan 31 07:47:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Jan 31 07:47:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-31 07:47:41 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:12650: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.209.153
description:
2025-01-31 07:48:32 dovecot_login authenticator failed for ([39.174.209.153]) [39.174.209.153]:56535: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 07:48:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.149
description:
Jan 31 07:48:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 31 07:49:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
description:
2025-01-31 07:49:12 dovecot_login authenticator failed for ([218.75.123.109]) [183.247.171.186]:50717: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
description:
Jan 31 07:49:16 ait sshd[1415262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
description:
Jan 31 07:49:16 ait sshd[1415262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-31 07:48:38 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:33802: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.182.166.112
description:
Jan 31 07:48:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.182.166.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.149
description:
2025-01-31 07:48:55 dovecot_plain authenticator failed for ([218.149.228.149]) [218.149.228.149]:36502: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.182.166.112
description:
2025-01-31 07:48:56 dovecot_login authenticator failed for (112.166.182.190.unassigned.ridsa.com.ar) [190.182.166.112]:48086: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 31 07:49:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.99.19
description:
[2025-01-31 07:49:26 +0100] info [webmaild] 45.187.99.19 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 31 07:48:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-31 07:48:33 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:58336: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 31 07:48:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.171.186
description:
Jan 31 07:49:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.171.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-31 07:49:06 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (patate) [51.255.84.180]:53488: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-31 07:49:23 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:57272: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 31 07:49:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-31 07:49:40 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:33044: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-31 07:49:50 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:52074: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 31 07:49:51 ait sshd[1415476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Jan 31 07:50:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-01-31 07:50:12 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:56700: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.212.174
description:
2025-01-31 07:50:23 dovecot_login authenticator failed for ([103.142.212.174]) [103.142.212.174]:33392: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 31 07:50:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 31 07:49:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 31 07:49:51 ait sshd[1415476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-31 07:49:39 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:53828: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 31 07:49:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Jan 31 07:50:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-01-31 07:50:09 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:40712: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.212.174
description:
Jan 31 07:50:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.212.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 07:49:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.129.75.22
description:
[2025-01-31 07:50:15 +0100] info [webmaild] 102.129.75.22 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-31 07:50:27 dovecot_plain authenticator failed for ([186.201.3.45]) [186.200.158.42]:47880: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
description:
Jan 31 07:51:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-31 07:51:16 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:54292: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 31 07:51:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Jan 31 07:51:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
description:
Jan 31 07:51:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Jan 31 07:50:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.225.113.16
description:
[2025-01-31 07:50:55 +0100] info [webmaild] 200.225.113.16 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.186.191
description:
2025-01-31 07:51:10 dovecot_login authenticator failed for m106153186191.v4.enabler.ne.jp [106.153.186.191]:51076: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-31 07:51:26 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:48058: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
description:
2025-01-31 07:51:13 dovecot_login authenticator failed for ([183.249.1.112]) [183.249.1.112]:46898: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-01-31 07:51:05 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:49698: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.153.186.191
description:
Jan 31 07:51:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.153.186.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 31 07:51:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Jan 31 07:51:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-01-31 07:50:44 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:36114: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Jan 31 07:50:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-01-31 07:50:54 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:55825: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Jan 31 07:51:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-01-31 07:51:29 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:16971: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-01-31 07:51:18 dovecot_plain authenticator failed for ([122.187.243.95]) [122.187.243.95]:33503: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-31 07:51:28 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:59660: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 31 07:51:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-31 07:51:39 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:60086: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 31 07:52:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Jan 31 07:51:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-31 07:51:54 dovecot_plain authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:54100: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.112.194.160
description:
2025-01-31 07:52:29 dovecot_plain authenticator failed for ([106.112.194.160]) [106.112.194.160]:40106: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.49.61.211
description:
Jan 31 07:51:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.49.61.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 31 07:51:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-31 07:51:31 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:57707: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-31 07:51:48 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:32827: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.107.55
description:
2025-01-31 07:52:07 dovecot_login authenticator failed for ([14.39.107.55]) [14.39.107.55]:52607: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.112.194.160
description:
Jan 31 07:52:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.112.194.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 31 07:51:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 31 07:51:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.107.55
description:
Jan 31 07:52:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.107.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-31 07:52:26 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:41257: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Jan 31 07:52:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
description:
Jan 31 07:52:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 31 07:51:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.251.23.95
description:
2025-01-31 07:51:59 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [171.251.23.95]:52415: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-31 07:52:18 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:48964: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-01-31 07:52:29 dovecot_login authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:60906: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-31 07:51:40 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:48974: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.23.95
description:
Jan 31 07:51:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.251.23.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
description:
2025-01-31 07:51:44 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:47554: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-01-31 07:51:55 dovecot_plain authenticator failed for (overeal) [89.175.253.49]:59572: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 31 07:52:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 31 07:51:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.152.101.72
description:
[2025-01-31 07:51:37 +0100] info [webmaild] 103.152.101.72 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-31 07:51:33 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:52616: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
description:
Jan 31 07:52:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
description:
Jan 31 07:52:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-31 07:53:17 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:57122: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 31 07:52:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Jan 31 07:53:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-01-31 07:53:12 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:44059: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-01-31 07:53:25 dovecot_login authenticator failed for ([60.167.19.30]) [60.167.19.30]:33501: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 31 07:53:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
description:
2025-01-31 07:52:35 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:51166: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Jan 31 07:52:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Jan 31 07:53:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-31 07:52:49 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:58732: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
description:
2025-01-31 07:52:52 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:56957: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
description:
2025-01-31 07:53:24 dovecot_plain authenticator failed for (nsg-corporate-81.230.187.122.airtel.in) [122.187.230.81]:48623: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 31 07:52:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.29.101
description:
2025-01-31 07:52:39 dovecot_login authenticator failed for (doserver.womenpla.net) [139.59.29.101]:53028: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-31 07:53:03 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:56087: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-31 07:52:38 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:29574: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.81
description:
Jan 31 07:53:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 31 07:53:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 31 07:53:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-31 07:53:29 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:46612: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.138.69
description:
Jan 31 07:52:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.138.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
description:
2025-01-31 07:52:49 dovecot_plain authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:56009: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.161.142
description:
[2025-01-31 07:52:52 +0100] info [webmaild] 45.186.161.142 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
description:
2025-01-31 07:52:56 dovecot_login authenticator failed for ([102.223.154.170]) [102.223.154.170]:43774: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
description:
2025-01-31 07:52:31 dovecot_login authenticator failed for ([114.108.127.188]) [114.108.127.188]:38952: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.29.101
description:
Jan 31 07:52:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.29.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
description:
Jan 31 07:53:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.189.77.99
description:
[2025-01-31 07:54:26 +0100] info [webmaild] 186.189.77.99 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 31 07:54:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.236.82.124
description:
2025-01-31 07:54:04 dovecot_login authenticator failed for (124.82.236.45.cable.dyn.ridsa.com.ar) [45.236.82.124]:51987: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
description:
2025-01-31 07:54:15 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:54822: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 31 07:54:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
description:
2025-01-31 07:53:45 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:44749: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Jan 31 07:53:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
description:
2025-01-31 07:53:53 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:42733: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
description:
Jan 31 07:54:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
description:
Jan 31 07:53:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
description:
Jan 31 07:53:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.82.124
description:
Jan 31 07:54:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.82.124 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.194.21.68
description:
[2025-01-31 07:53:42 +0100] info [webmaild] 168.194.21.68 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 07:53:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
description:
Jan 31 07:53:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-31 07:54:16 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:36140: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-01-31 07:53:33 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:26173: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-31 07:54:29 dovecot_login authenticator failed for ([223.26.225.129]) [210.206.24.234]:62494: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-31 07:53:31 dovecot_plain authenticator failed for ([200.232.71.201]) [189.108.147.210]:60732: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-01-31 07:53:36 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:57188: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-01-31 07:53:41 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:49178: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 31 07:53:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-31 07:53:47 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:48760: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Jan 31 07:53:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.107.239.57
description:
[2025-01-31 07:55:08 +0100] info [webmaild] 95.107.239.57 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-56.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.67.31
description:
[2025-01-31 07:56:16 +0100] info [webmaild] 138.97.67.31 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.32.96.252
description:
Jan 31 07:56:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.32.96.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
description:
2025-01-31 07:56:25 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:41430: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.57.239.90
description:
[2025-01-31 07:57:05 +0100] info [webmaild] 213.57.239.90 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.49.14
description:
Jan 31 07:57:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.49.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 31 07:56:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 31 07:56:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-31 07:56:36 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:40493: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-31 07:56:47 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:55880: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 31 07:56:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 07:56:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
description:
2025-01-31 07:57:18 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:28334: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-31 07:56:58 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:36776: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
description:
2025-01-31 07:58:07 dovecot_login authenticator failed for ([111.61.176.242]) [111.61.176.242]:10704: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
description:
Jan 31 07:58:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-01-31 07:58:18 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:42690: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.3.57.67
description:
[2025-01-31 07:57:49 +0100] info [webmaild] 186.3.57.67 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 31 07:58:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.242
description:
Jan 31 07:58:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-31 07:58:07 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:27480: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-01-31 07:58:12 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:35398: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 31 07:58:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-01-31 07:58:18 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:40972: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-31 07:58:20 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:54993: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-31 07:57:55 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:42074: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.82.131.20
description:
2025-01-31 07:57:34 dovecot_login authenticator failed for ([184.82.131.20]) [184.82.131.20]:51194: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-31 07:57:51 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:36598: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.82.131.20
description:
Jan 31 07:57:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.82.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 31 07:57:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.16.137
description:
Jan 31 07:57:58 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.6.16.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
description:
2025-01-31 07:58:00 dovecot_plain authenticator failed for ([14.6.16.137]) [14.6.16.137]:59235: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.18.139.82
description:
Jan 31 07:58:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.18.139.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Jan 31 07:58:16 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Jan 31 07:58:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
description:
2025-01-31 07:58:24 dovecot_login authenticator failed for ([221.2.207.134]) [221.2.207.134]:60005: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 31 07:57:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 31 07:59:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 31 07:59:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.63.85.174
description:
[2025-01-31 07:58:32 +0100] info [webmaild] 197.63.85.174 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
description:
2025-01-31 07:58:35 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:48340: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 31 07:58:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.34.26
description:
2025-01-31 07:59:19 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:48129: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-31 07:59:17 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:60762: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Jan 31 07:59:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-01-31 07:59:22 dovecot_login authenticator failed for ([188.227.66.92]) [188.227.66.92]:53228: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-31 07:58:38 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:53238: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 07:58:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 07:59:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 31 07:59:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 31 07:59:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-31 07:58:36 dovecot_login authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:28652: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
description:
2025-01-31 07:58:53 dovecot_plain authenticator failed for ([117.158.166.73]) [117.158.166.73]:47584: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 07:58:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 31 07:59:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-31 07:58:58 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:3753: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 31 07:59:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
description:
Jan 31 07:59:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
description:
Jan 31 07:58:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.166.73
description:
Jan 31 07:58:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.166.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.190
description:
Jan 31 07:59:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
description:
2025-01-31 07:59:29 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:45154: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 31 07:58:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 31 07:58:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-31 07:59:14 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:38079: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.190
description:
2025-01-31 07:59:24 dovecot_login authenticator failed for ([122.187.229.190]) [122.187.229.190]:46203: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-31 07:59:08 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:53142: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-31 07:59:19 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:41061: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
description:
Jan 31 07:59:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-31 07:59:41 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:34122: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-01-31 07:59:36 dovecot_login authenticator failed for ([121.174.189.52]) [121.174.189.52]:44052: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-31 07:59:56 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:60910: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 31 08:00:03 ait sshd[1419447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 31 07:59:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-31 07:59:54 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:59979: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Jan 31 08:00:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
description:
2025-01-31 07:59:34 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:43350: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.10.16.21
description:
[2025-01-31 07:59:41 +0100] info [webmaild] 95.10.16.21 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.30.170
description:
Jan 31 07:59:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.30.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
description:
2025-01-31 08:00:12 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:40092: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.166.252
description:
[2025-01-31 08:00:30 +0100] info [webmaild] 45.229.166.252 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
description:
Jan 31 07:59:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 31 07:59:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
description:
2025-01-31 07:59:49 dovecot_login authenticator failed for ([61.185.30.170]) [61.185.30.170]:34658: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
description:
Jan 31 08:00:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-01-31 08:00:08 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:52726: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-01-31 07:59:35 dovecot_login authenticator failed for ([60.171.237.143]) [60.171.237.143]:58088: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.34.189.181
description:
Jan 31 07:59:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.34.189.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 31 07:59:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.34.189.181
description:
2025-01-31 07:59:53 dovecot_login authenticator failed for net-2-34-189-181.cust.vodafonedsl.it [2.34.189.181]:37782: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
description:
2025-01-31 07:59:31 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:56046: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-31 07:59:33 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:45386: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Jan 31 07:59:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Jan 31 08:00:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-01-31 08:00:31 dovecot_login authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:27751: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
description:
Jan 31 07:59:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-01-31 08:02:05 dovecot_plain authenticator failed for ([179.127.197.89]) [179.127.197.89]:56884: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.204.209.15
description:
[2025-01-31 08:01:38 +0100] info [webmaild] 103.204.209.15 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-01-31 08:01:39 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:48296: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.212.68
description:
Jan 31 08:02:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.212.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
description:
Jan 31 08:02:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 31 08:01:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 31 08:02:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-31 08:02:24 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:51839: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 31 08:02:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-01-31 08:02:23 dovecot_login authenticator failed for ([223.71.98.202]) [223.71.98.202]:33746: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-31 08:01:51 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:57316: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.212.68
description:
2025-01-31 08:02:05 dovecot_login authenticator failed for ([111.39.212.68]) [111.39.212.68]:48109: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Jan 31 08:02:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-31 08:02:20 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:57570: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-31 08:02:06 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:34496: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.193.149
description:
[2025-01-31 08:02:18 +0100] info [webmaild] 201.17.193.149 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Jan 31 08:01:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 31 08:01:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-31 08:01:49 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:36088: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 31 08:02:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-31 08:02:38 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:47774: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.157.126
description:
Jan 31 08:03:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.157.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
description:
2025-01-31 08:03:16 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:37521: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 31 08:03:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.29.232.114
description:
Jan 31 08:03:10 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.29.232.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 08:02:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 31 08:02:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Jan 31 08:02:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 31 08:02:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-31 08:02:54 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:52888: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-03.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 31 08:02:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-31 08:02:35 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:46927: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-31 08:02:36 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au ([203.194.21.194]) [110.175.220.250]:33104: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-01-31 08:02:47 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:34503: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.138.121.18
description:
Jan 31 08:02:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.138.121.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-31 08:03:23 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4769: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 31 08:02:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.138.121.18
description:
2025-01-31 08:02:58 dovecot_login authenticator failed for (undefined.hostname.localhost) [120.138.121.18]:49708: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.157.126
description:
2025-01-31 08:03:04 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:48459: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.29.232.114
description:
2025-01-31 08:03:12 dovecot_login authenticator failed for (c20029232-114.consulnetworks.com.co) [200.29.232.114]:56266: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Jan 31 08:03:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.253.175
description:
Jan 31 08:03:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 31 08:03:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.253.175
description:
2025-01-31 08:03:33 dovecot_login authenticator failed for ([90.188.253.175]) [90.188.253.175]:55105: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.59.244.16
description:
[2025-01-31 08:03:33 +0100] info [webmaild] 95.59.244.16 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Jan 31 08:03:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.75.112
description:
[2025-01-31 08:04:20 +0100] info [webmaild] 138.255.75.112 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.9.38.174
description:
Jan 31 08:04:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.9.38.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-01-31 08:05:03 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:53590: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-01-31 08:05:14 dovecot_plain authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:56767: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.9.38.174
description:
2025-01-31 08:04:33 dovecot_login authenticator failed for ([76.9.38.174]) [76.9.38.174]:39590: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
description:
Jan 31 08:04:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 08:04:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.175
description:
Jan 31 08:04:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Jan 31 08:05:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
description:
2025-01-31 08:04:41 dovecot_plain authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:2736: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
description:
2025-01-31 08:04:45 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:46974: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
description:
Jan 31 08:05:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 08:04:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Jan 31 08:05:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.82
description:
[2025-01-31 08:05:02 +0100] info [webmaild] 198.163.193.82 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-31 08:05:02 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:10988: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Jan 31 08:06:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 31 08:06:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.83.22
description:
2025-01-31 08:06:22 dovecot_plain authenticator failed for (2-54-83-22.orange.net.il) [2.54.83.22]:57105: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 31 08:05:37 ait sshd[1422194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 31 08:05:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.250.11.58
description:
[2025-01-31 08:05:45 +0100] info [webmaild] 190.250.11.58 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-31 08:05:45 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:16883: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Jan 31 08:06:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Jan 31 08:05:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 31 08:05:37 ait sshd[1422194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-01-31 08:05:48 dovecot_plain authenticator failed for ([220.248.205.14]) [220.248.205.14]:1381: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-01-31 08:06:02 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:36632: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-31 08:06:11 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:42966: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.83.22
description:
Jan 31 08:06:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.83.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-01-31 08:06:24 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:46500: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-01-31 08:05:32 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:44530: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Jan 31 08:05:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.240
description:
2025-01-31 08:06:48 dovecot_plain authenticator failed for 111-70-13-240.emome-ip.hinet.net [111.70.13.240]:38243: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
description:
Jan 31 08:06:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Jan 31 08:06:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.58
description:
2025-01-31 08:07:26 dovecot_plain authenticator failed for ([91.227.31.58]) [91.227.31.58]:33128: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 31 08:06:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
description:
2025-01-31 08:06:54 dovecot_plain authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:58820: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.236.237
description:
2025-01-31 08:07:03 dovecot_plain authenticator failed for ([118.43.236.237]) [118.43.236.237]:42922: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.13.240
description:
Jan 31 08:06:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.13.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 31 08:07:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 08:07:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.58
description:
Jan 31 08:07:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-31 08:06:41 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:19756: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-01-31 08:06:56 dovecot_login authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:19044: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.43.236.237
description:
Jan 31 08:07:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.43.236.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.190.70.190
description:
[2025-01-31 08:06:59 +0100] info [webmaild] 177.190.70.190 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-31 08:07:23 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:48835: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Jan 31 08:07:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-31 08:08:02 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:54225: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
description:
2025-01-31 08:08:11 dovecot_login authenticator failed for ([103.132.199.18]) [103.132.199.18]:40851: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
description:
2025-01-31 08:08:21 dovecot_login authenticator failed for ([122.225.55.98]) [122.225.55.98]:50186: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 31 08:07:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 31 08:07:41 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-01-31 08:07:59 dovecot_login authenticator failed for ([61.184.26.197]) [61.184.26.197]:56662: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.174.35
description:
Jan 31 08:08:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.174.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 31 08:08:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-31 08:08:04 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:39566: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
description:
Jan 31 08:08:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Jan 31 08:07:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.49.14
description:
Jan 31 08:07:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.49.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.48.27
description:
Jan 31 08:07:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.48.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.111
description:
Jan 31 08:07:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
description:
2025-01-31 08:08:27 dovecot_login authenticator failed for ([119.207.83.89]) [119.207.83.89]:51331: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.19.94
description:
Jan 31 08:08:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.19.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
description:
Jan 31 08:07:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 31 08:07:42 ait sshd[1422947]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.19.94
description:
2025-01-31 08:08:11 dovecot_login authenticator failed for ([187.50.19.94]) [187.50.19.94]:45031: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.83.89
description:
Jan 31 08:08:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.83.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 31 08:07:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 31 08:07:42 ait sshd[1422947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 31 08:07:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
description:
Jan 31 08:08:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.45.194
description:
47.128.45.194 - - [31/Jan/2025:08:08:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10104527 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/64e32e?panel=twig" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.45.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 31 08:08:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-01-31 08:07:57 dovecot_login authenticator failed for ([112.220.235.237]) [112.220.235.237]:54256: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 08:08:14 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-31 08:07:34 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:16251: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-31 08:07:43 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:19666: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.242.204.22
description:
Jan 31 08:07:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.242.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.27
description:
2025-01-31 08:07:51 dovecot_login authenticator failed for 111-70-48-27.emome-ip.hinet.net [111.70.48.27]:40715: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
description:
2025-01-31 08:07:50 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:54010: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Jan 31 08:07:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 08:07:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.201.51
description:
Jan 31 08:07:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.201.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 31 08:08:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
description:
2025-01-31 08:08:24 dovecot_plain authenticator failed for ([122.186.174.35]) [122.186.174.35]:57100: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-01-31 08:07:45 dovecot_login authenticator failed for ([90.189.180.243]) [90.189.180.243]:43939: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.174.188.51
description:
[2025-01-31 08:07:46 +0100] info [webmaild] 201.174.188.51 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.201.51
description:
2025-01-31 08:07:58 dovecot_login authenticator failed for ([196.46.201.51]) [196.46.201.51]:33940: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-31 08:08:07 dovecot_login authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:47753: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-31 08:08:13 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:36259: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-31 08:07:36 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:34778: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
description:
2025-01-31 08:07:39 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:47562: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.242.204.22
description:
2025-01-31 08:07:50 dovecot_login authenticator failed for ([222.242.204.22]) [222.242.204.22]:5204: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.111
description:
2025-01-31 08:07:58 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:42019: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 31 08:08:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-31 08:07:50 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:49592: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 31 08:09:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-31 08:09:07 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:35411: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-31 08:09:15 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:32964: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.115.90
description:
Jan 31 08:09:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.115.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 31 08:09:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Jan 31 08:09:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
description:
2025-01-31 08:09:24 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:52460: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-09.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
description:
Jan 31 08:09:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 31 08:09:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-31 08:09:27 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:33338: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.167.63
description:
[2025-01-31 08:08:36 +0100] info [webmaild] 90.156.167.63 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.115.90
description:
2025-01-31 08:09:20 dovecot_plain authenticator failed for (abts-north-static-090.115.160.122.airtelbroadband.in) [122.160.115.90]:47246: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-31 08:09:24 dovecot_plain authenticator failed for ([91.234.132.226]) [91.234.132.226]:52863: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Jan 31 08:09:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 31 08:09:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.158.207.66
description:
[2025-01-31 08:09:18 +0100] info [webmaild] 102.158.207.66 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-01-31 08:09:25 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:33912: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 31 08:09:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 31 08:09:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.246.91
description:
2025-01-31 08:09:48 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:45552: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-31 08:10:02 dovecot_login authenticator failed for (undefined.hostname.localhost) [182.76.87.90]:60968: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 31 08:10:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-01-31 08:09:30 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:34173: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 31 08:09:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.165.114
description:
2025-01-31 08:09:53 dovecot_plain authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:55442: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.20.253.109
description:
Jan 31 08:09:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.20.253.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
description:
2025-01-31 08:09:44 dovecot_plain authenticator failed for ([116.113.253.142]) [116.113.253.142]:38665: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-01-31 08:09:46 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:19748: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 31 08:10:11 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.165.114
description:
Jan 31 08:09:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 31 08:10:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 31 08:10:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-31 08:09:30 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:52156: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
description:
2025-01-31 08:09:33 dovecot_plain authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:46156: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Jan 31 08:09:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.193.70
description:
Jan 31 08:09:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.193.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
description:
2025-01-31 08:09:50 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:59280: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 31 08:10:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Jan 31 08:09:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-31 08:09:39 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:52647: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-01-31 08:09:39 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:17777: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.198.31
description:
Jan 31 08:09:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.198.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.148
description:
2025-01-31 08:10:21 dovecot_plain authenticator failed for ([27.40.100.148]) [27.40.100.148]:49039: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-31 08:10:21 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:33060: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
description:
2025-01-31 08:09:32 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:39462: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
description:
2025-01-31 08:09:48 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:60365: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-31 08:10:09 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:50653: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-31 08:10:13 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:42410: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.148
description:
Jan 31 08:10:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
description:
Jan 31 08:09:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.142
description:
Jan 31 08:09:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-31 08:10:02 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:40328: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
description:
Jan 31 08:11:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
description:
2025-01-31 08:11:22 dovecot_plain authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:56466: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.225.167.88
description:
[2025-01-31 08:11:22 +0100] info [webmaild] 88.225.167.88 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.85.53
description:
[2025-01-31 08:10:34 +0100] info [webmaild] 191.5.85.53 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Jan 31 08:10:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
description:
Jan 31 08:10:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
description:
2025-01-31 08:10:39 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:60310: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
description:
2025-01-31 08:10:42 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:57782: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Jan 31 08:11:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.78
description:
Jan 31 08:11:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.78
description:
2025-01-31 08:11:36 dovecot_plain authenticator failed for ([39.152.196.78]) [39.152.196.78]:33795: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-01-31 08:11:35 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:53808: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 31 08:11:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-31 08:11:53 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:23803: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.149.206
description:
[2025-01-31 08:12:14 +0100] info [webmaild] 201.17.149.206 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-31 08:12:53 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:49135: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.149.245.15
description:
[2025-01-31 08:12:56 +0100] info [webmaild] 186.149.245.15 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 31 08:12:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.23.209.47
description:
Jan 31 08:13:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.23.209.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-31 08:13:26 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:40399: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
description:
2025-01-31 08:13:27 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:59548: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.83.205
description:
2025-01-31 08:12:49 dovecot_login authenticator failed for ([94.205.83.205]) [94.205.83.205]:52369: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 31 08:12:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 31 08:12:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-31 08:12:58 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:49606: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
description:
2025-01-31 08:13:14 dovecot_plain authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:39805: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
description:
Jan 31 08:13:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-31 08:12:58 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:48084: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-31 08:13:22 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:36683: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 31 08:13:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
description:
2025-01-31 08:13:29 dovecot_login authenticator failed for ([39.165.61.209]) [39.165.61.209]:59004: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.83.205
description:
Jan 31 08:12:47 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Jan 31 08:13:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-01-31 08:13:08 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:40908: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 31 08:13:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
description:
Jan 31 08:13:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.255.28.12
description:
2025-01-31 08:13:54 dovecot_plain authenticator failed for 12.sub-166-255-28.myvzw.com [166.255.28.12]:24367: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-01-31 08:13:55 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:56892: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
description:
2025-01-31 08:14:04 dovecot_plain authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:52440: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Jan 31 08:13:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-01-31 08:13:36 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:58384: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 08:13:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.255.28.12
description:
Jan 31 08:13:52 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.255.28.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
description:
Jan 31 08:13:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
description:
Jan 31 08:14:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.180.244
description:
[2025-01-31 08:14:04 +0100] info [webmaild] 187.62.180.244 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-01-31 08:15:26 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:45034: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-01-31 08:15:05 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:64830: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Jan 31 08:15:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
description:
Jan 31 08:15:24 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
description:
Jan 31 08:15:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Jan 31 08:15:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-01-31 08:15:24 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:39400: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Jan 31 08:15:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
description:
Jan 31 08:15:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.46.143.19
description:
[2025-01-31 08:14:50 +0100] info [webmaild] 95.46.143.19 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
description:
2025-01-31 08:15:19 dovecot_plain authenticator failed for ([118.26.153.102]) [118.26.153.102]:17558: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-01-31 08:15:28 dovecot_login authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:34576: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
description:
2025-01-31 08:15:28 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:49402: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 08:14:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Jan 31 08:16:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-01-31 08:16:08 dovecot_login authenticator failed for ([179.125.124.14]) [179.125.124.14]:60926: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-31 08:16:22 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:14166: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.142.14
description:
Jan 31 08:16:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.142.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 31 08:16:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 08:15:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
description:
Jan 31 08:15:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.235.171.171
description:
[2025-01-31 08:15:52 +0100] info [webmaild] 179.235.171.171 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 08:16:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
description:
Jan 31 08:15:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-31 08:15:41 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:34616: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 31 08:16:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 31 08:15:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.239.144
description:
2025-01-31 08:15:36 dovecot_login authenticator failed for ([178.158.239.144]) [178.158.239.144]:51258: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.158.239.144
description:
Jan 31 08:15:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.158.239.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-31 08:16:21 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:58054: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
description:
2025-01-31 08:15:42 dovecot_plain authenticator failed for ([61.177.36.109]) [153.37.177.219]:50582: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-01-31 08:15:44 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:34633: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
description:
2025-01-31 08:15:45 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:37269: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.142.14
description:
2025-01-31 08:16:21 dovecot_plain authenticator failed for ([39.164.142.14]) [39.164.142.14]:33418: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Jan 31 08:15:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.162.28
description:
2025-01-31 08:17:05 dovecot_plain authenticator failed for ([190.185.162.28]) [190.185.162.28]:34708: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
description:
2025-01-31 08:17:07 dovecot_plain authenticator failed for ([113.59.34.8]) [113.59.34.5]:43656: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.132.200
description:
2025-01-31 08:17:25 dovecot_plain authenticator failed for ([157.122.132.200]) [157.122.132.200]:46806: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Jan 31 08:17:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
description:
Jan 31 08:17:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.101.124
description:
2025-01-31 08:16:48 dovecot_plain authenticator failed for ([186.96.101.124]) [186.96.101.124]:47537: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
description:
2025-01-31 08:16:53 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:50984: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.59.34.5
description:
Jan 31 08:17:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.59.34.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-31 08:17:15 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:36144: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.251.57.55
description:
Jan 31 08:17:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.251.57.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.193
description:
2025-01-31 08:17:19 dovecot_plain authenticator failed for 110-25-104-193.adsl.fetnet.net [110.25.104.193]:56367: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.57.55
description:
2025-01-31 08:17:20 dovecot_login authenticator failed for (55.57.251.198.in-addr.arpa) [198.251.57.55]:44517: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 31 08:17:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.162.28
description:
Jan 31 08:17:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.162.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-31 08:17:04 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:39417: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.75.128.136
description:
[2025-01-31 08:17:28 +0100] info [webmaild] 196.75.128.136 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.107.99.194
description:
[2025-01-31 08:16:38 +0100] info [webmaild] 177.107.99.194 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.101.124
description:
Jan 31 08:16:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.101.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
description:
Jan 31 08:16:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-01-31 08:17:30 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:36807: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.110.9
description:
47.128.110.9 - - [31/Jan/2025:08:17:11 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9625756 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-category/big-data/?duration=long&filtering=1&tutor-course-filter-category=229" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.9


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.193
description:
Jan 31 08:17:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.132.200
description:
Jan 31 08:17:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.132.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.63.37
description:
Jan 31 08:17:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.47.63.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.158.18.129
description:
2025-01-31 08:17:56 dovecot_plain authenticator failed for (ancenes) [94.158.18.129]:33038: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Jan 31 08:18:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
description:
Jan 31 08:18:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
description:
2025-01-31 08:18:21 dovecot_plain authenticator failed for ([61.2.44.54]) [61.2.44.54]:39630: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.230
description:
2025-01-31 08:18:27 dovecot_login authenticator failed for ([113.64.208.230]) [113.64.208.230]:53184: 535 Incorrect authentication data (set_id=jaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.46
description:
2025-01-31 08:17:38 dovecot_login authenticator failed for ([91.73.195.46]) [91.73.195.46]:47609: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.158.18.129
description:
Jan 31 08:17:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.158.18.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.111.139.88
description:
2025-01-31 08:17:58 dovecot_plain authenticator failed for pool-98-111-139-88.phlapa.fios.verizon.net [98.111.139.88]:47752: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 08:18:15 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.47.63.37
description:
2025-01-31 08:17:41 dovecot_plain authenticator failed for ([95.47.63.37]) [95.47.63.37]:54846: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-01-31 08:17:44 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:40982: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.52.115.214
description:
[2025-01-31 08:18:15 +0100] info [webmaild] 176.52.115.214 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 31 08:18:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.230
description:
Jan 31 08:18:25 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
description:
2025-01-31 08:17:31 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:38368: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-01-31 08:18:17 dovecot_login authenticator failed for ([111.172.120.32]) [111.172.120.32]:53954: 535 Incorrect authentication data (set_id=jaster@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-31 08:18:19 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:37252: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.46
description:
Jan 31 08:17:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Jan 31 08:17:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.111.139.88
description:
Jan 31 08:17:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.111.139.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Jan 31 08:18:32 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-01-31 08:18:46 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:52486: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 08:19:06 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
description:
Jan 31 08:19:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.248.0.242
description:
Jan 31 08:19:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.248.0.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
description:
2025-01-31 08:19:21 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:52940: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.184.119.106
description:
2025-01-31 08:19:28 dovecot_plain authenticator failed for ([117.184.119.106]) [117.184.119.106]:28079: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Jan 31 08:18:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 08:19:01 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.149.88
description:
Jan 31 08:19:04 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.149.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.81
description:
Jan 31 08:19:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.22.124
description:
2025-01-31 08:19:30 dovecot_login authenticator failed for ([94.207.22.124]) [94.207.22.124]:35474: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-01-31 08:18:34 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:53689: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Jan 31 08:18:44 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.212.187.27
description:
2025-01-31 08:18:51 dovecot_plain authenticator failed for ([103.250.160.76]) [117.212.187.27]:39980: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-31 08:19:10 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:38055: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-19.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
description:
2025-01-31 08:19:29 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:35412: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.158.10.60
description:
Jan 31 08:18:39 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.158.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 31 08:19:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 31 08:19:17 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Jan 31 08:19:18 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-01-31 08:19:20 dovecot_login authenticator failed for ([122.187.243.95]) [122.187.243.95]:36585: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.22.124
description:
Jan 31 08:19:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.22.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-01-31 08:18:35 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:9898: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-01-31 08:18:57 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:47600: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
description:
2025-01-31 08:19:06 dovecot_plain authenticator failed for ([82.102.149.88]) [82.102.149.88]:53617: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
description:
2025-01-31 08:19:14 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:56966: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-31 08:19:19 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:17501: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.184.119.106
description:
Jan 31 08:19:26 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.184.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.0.242
description:
2025-01-31 08:19:29 dovecot_login authenticator failed for ([103.15.60.138]) [218.248.0.242]:47528: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Jan 31 08:18:33 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.10.60
description:
2025-01-31 08:18:41 dovecot_plain authenticator failed for (95.158.10.60.bestsolution.net.ua) [95.158.10.60]:33986: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.212.187.27
description:
Jan 31 08:18:49 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.212.187.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
description:
Jan 31 08:19:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.169
description:
2025-01-31 08:19:40 dovecot_plain authenticator failed for ([218.149.228.169]) [218.149.228.169]:59742: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 31 08:19:42 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.75.209.98
description:
2025-01-31 08:20:12 dovecot_login authenticator failed for ([49.75.209.98]) [49.75.209.98]:47056: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.107
description:
2025-01-31 08:19:33 dovecot_plain authenticator failed for ([196.46.200.107]) [196.46.200.107]:51279: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
description:
Jan 31 08:19:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.107
description:
Jan 31 08:19:31 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
description:
Jan 31 08:19:48 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-01-31 08:19:50 dovecot_plain authenticator failed for ([200.125.14.122]) [200.125.14.122]:46352: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.160
description:
Jan 31 08:20:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-31 08:19:42 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:48233: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-31 08:19:44 dovecot_plain authenticator failed for (ablist) [109.166.70.166]:1424: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Jan 31 08:19:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-01-31 08:19:48 dovecot_login authenticator failed for ([59.24.194.207]) [59.24.194.207]:35707: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.49.80.192
description:
[2025-01-31 08:19:32 +0100] info [webmaild] 190.49.80.192 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.169
description:
Jan 31 08:19:38 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
description:
2025-01-31 08:19:59 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:55265: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.253.175
description:
Jan 31 08:20:13 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.9.81
description:
[2025-01-31 08:20:14 +0100] info [webmaild] 181.46.9.81 - account@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.160
description:
2025-01-31 08:20:23 dovecot_plain authenticator failed for 202-4-196-160.static.pccw-hkt.com [202.4.196.160]:42422: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 31 08:19:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
description:
Jan 31 08:20:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
description:
2025-01-31 08:20:04 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:48480: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 08:20:23 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-01-31 08:21:14 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:38242: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.207
description:
Jan 31 08:20:57 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
description:
2025-01-31 08:20:57 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:33458: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Jan 31 08:21:00 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.207
description:
2025-01-31 08:20:59 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:38240: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-31 08:20:55 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:51428: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
description:
2025-01-31 08:21:05 dovecot_plain authenticator failed for ([197.156.115.37]) [197.156.115.37]:38334: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.2.202
description:
Jan 31 08:20:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
description:
Jan 31 08:21:05 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-31 08:21:22 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:61309: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
description:
Jan 31 08:20:34 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 172.104.187.239
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-20.172.104.187.239


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-31 08:20:47 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:39894: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.127.186
description:
[2025-01-31 08:20:59 +0100] info [webmaild] 177.38.127.186 - account@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 31 08:21:20 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 31 08:20:53 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Jan 31 08:21:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 31 08:20:45 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
description:
Jan 31 08:20:55 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
description:
Jan 31 08:21:03 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-01-31 08:21:02 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:60174: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 31 08:21:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 31 08:21:59 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.63.214.213
description:
Jan 31 08:22:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.63.214.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-01-31 08:22:11 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:59098: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.128.196.59
description:
2025-01-31 08:22:24 dovecot_login authenticator failed for ([127.0.0.1]) [183.128.196.59]:44704: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 31 08:22:29 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 31 08:21:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
description:
Jan 31 08:21:37 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Jan 31 08:21:51 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Jan 31 08:22:21 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-01-31 08:22:23 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:52186: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
description:
Jan 31 08:22:08 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
description:
Jan 31 08:21:43 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
description:
2025-01-31 08:22:10 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:36388: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.128.196.59
description:
Jan 31 08:22:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.128.196.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
description:
2025-01-31 08:21:45 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:38180: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-31 08:21:53 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:50972: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-31 08:22:01 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:36798: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-22.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.90.89.66
description:
Jan 31 08:22:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.90.89.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
description:
2025-01-31 08:22:11 dovecot_plain authenticator failed for ([218.15.222.74]) [58.63.214.213]:7642: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
description:
2025-01-31 08:21:39 dovecot_plain authenticator failed for ([14.23.77.27]) [14.23.77.27]:32921: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.122.185.190
description:
[2025-01-31 08:21:47 +0100] info [webmaild] 190.122.185.190 - account@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Jan 31 08:22:09 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-31 08:21:38 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:53704: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-31 08:21:38 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:59882: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
description:
2025-01-31 08:22:14 dovecot_login authenticator failed for ([127.0.0.1]) [66.90.89.66]:41708: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.8.22.30
description:
Jan 31 08:22:54 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.8.22.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-01-31 08:23:04 dovecot_login authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:42018: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.152.26
description:
2025-01-31 08:23:14 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.152.26]:35569: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-31 08:22:32 dovecot_plain authenticator failed for ([182.70.120.127]) [182.70.120.127]:50256: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-01-31 08:22:37 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:58900: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.191.82
description:
2025-01-31 08:22:42 dovecot_plain authenticator failed for ([113.108.191.82]) [113.108.191.82]:33284: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.202.234.34
description:
Jan 31 08:22:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.202.234.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
description:
2025-01-31 08:22:58 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:55946: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Jan 31 08:23:07 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
description:
Jan 31 08:23:19 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
description:
Jan 31 08:23:22 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
description:
Jan 31 08:22:30 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
description:
Jan 31 08:22:56 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.226.132.154
description:
[2025-01-31 08:22:59 +0100] info [webmaild] 160.226.132.154 - account@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
description:
2025-01-31 08:23:21 dovecot_login authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru ([127.0.0.1]) [87.240.58.132]:40356: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.8.22.30
description:
2025-01-31 08:22:56 dovecot_plain authenticator failed for (30.22.8.221.adsl-pool.jlccptt.net.cn) [221.8.22.30]:45135: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Jan 31 08:23:02 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.191.82
description:
Jan 31 08:22:40 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.191.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
description:
2025-01-31 08:23:24 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:36090: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 08:23:28 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Jan 31 08:22:36 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.152.26
description:
Jan 31 08:23:12 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.152.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-01-31 08:22:38 dovecot_plain authenticator failed for ([196.207.241.168]) [196.207.241.168]:51112: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-31 08:22:31 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:35094: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Jan 31 08:22:35 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.202.234.34
description:
2025-01-31 08:22:52 dovecot_login authenticator failed for ([5.202.234.34]) [5.202.234.34]:49725: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-01-31 08:23:09 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:63134: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.93
description:
47.128.112.93 - - [31/Jan/2025:08:23:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16171017 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=538" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.93


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.45.10
description:
Jan 31 08:23:50 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
description:
2025-01-31 08:23:56 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:46513: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 31 08:24:27 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Jan 31 08:23:46 ait auth[1397240]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.45.10
description:
2025-01-31 08:23:52 dovecot_plain authenticator failed for ([125.32.45.10]) [125.32.45.10]:53250: 535 Incorrect authentication data (set_id=ads06a99959y)


