# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:04:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.153.49
description:
Jan 28 10:05:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.153.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
description:
2025-01-28 10:05:57 dovecot_plain authenticator failed for ([221.2.153.49]) [221.2.153.49]:44830: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
description:
2025-01-28 10:07:44 dovecot_plain authenticator failed for ([5.166.68.184]) [5.166.68.184]:51472: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.31.6
description:
[2025-01-28 10:07:05 +0100] info [webmaild] 45.171.31.6 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.231.185.228
description:
2025-01-28 10:07:35 dovecot_plain authenticator failed for ([212.231.185.228]) [212.231.185.228]:59497: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.47
description:
2025-01-28 10:07:40 dovecot_plain authenticator failed for (inaill) [65.20.193.47]:48185: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.74.236.221
description:
[2025-01-28 10:07:19 +0100] info [webmaild] 177.74.236.221 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
description:
Jan 28 10:07:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.234.151.178
description:
Jan 28 10:07:20 ait sshd[3546273]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.234.151.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.234.151.178
description:
Jan 28 10:07:20 ait sshd[3546273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.234.151.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.231.185.228
description:
Jan 28 10:07:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.231.185.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.47
description:
Jan 28 10:07:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 28 10:08:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.132.109
description:
Jan 28 10:08:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.132.109 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 28 10:08:42 ait sshd[3546634]: Invalid user universitypublishing from 116.122.157.193 port 35454


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 10:08:42 ait sshd[3546634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-28 10:08:19 dovecot_plain authenticator failed for ([140.246.50.122]) [203.34.57.78]:57472: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Jan 28 10:08:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
description:
2025-01-28 10:08:27 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:60011: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Jan 28 10:08:28 ait sshd[3546610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-01-28 10:08:27 dovecot_plain authenticator failed for ([95.79.20.9]) [95.79.20.9]:60932: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Jan 28 10:08:28 ait sshd[3546610]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.132.109
description:
2025-01-28 10:08:39 dovecot_plain authenticator failed for ([36.138.132.109]) [36.138.132.109]:49342: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 10:08:42 ait sshd[3546634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
description:
Jan 28 10:08:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.234.151.178
description:
Jan 28 10:11:02 ait sshd[3547778]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.234.151.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.234.151.178
description:
Jan 28 10:11:02 ait sshd[3547778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.234.151.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 28 10:11:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-28 10:11:50 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (dioliff) [81.237.110.29]:53642: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 10:12:37 ait sshd[3548346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.234.151.178
description:
Jan 28 10:12:39 ait sshd[3548350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.234.151.178


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 10:12:37 ait sshd[3548346]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.100.89.79
description:
[2025-01-28 10:12:41 +0100] info [webmaild] 131.100.89.79 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.177.145.123
description:
[2025-01-28 10:12:40 +0100] info [webmaild] 79.177.145.123 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.110.194
description:
Jan 28 10:12:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.110.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.110.194
description:
2025-01-28 10:12:44 dovecot_login authenticator failed for host194.sub-63-46-110.myvzw.com [63.46.110.194]:32968: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.234.151.178
description:
Jan 28 10:12:41 ait sshd[3548350]: Failed password for invalid user kavita from 103.234.151.178 port 46782 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.234.151.178
description:
Jan 28 10:12:39 ait sshd[3548350]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.234.151.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-01-28 10:12:56 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:55841: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-28 10:13:13 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:30880: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
description:
2025-01-28 10:13:29 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:55246: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Jan 28 10:13:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-01-28 10:13:39 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:37892: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.138.66.223
description:
[2025-01-28 10:12:55 +0100] info [webmaild] 200.138.66.223 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 28 10:12:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-28 10:12:55 dovecot_plain authenticator failed for ([116.90.97.209]) [116.90.97.209]:49845: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.218.205
description:
[2025-01-28 10:13:47 +0100] info [webmaild] 45.185.218.205 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 28 10:13:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
description:
Jan 28 10:13:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.17.47
description:
[2025-01-28 10:13:43 +0100] info [webmaild] 177.104.17.47 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 28 10:12:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 10:13:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.45
description:
[2025-01-28 10:13:52 +0100] info [webmaild] 213.230.86.45 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-01-28 10:14:08 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:55328: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.157.14
description:
[2025-01-28 10:14:16 +0100] info [webmaild] 168.197.157.14 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.240.37.74
description:
Jan 28 10:14:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.240.37.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.52.54
description:
[2025-01-28 10:14:32 +0100] info [webmaild] 143.255.52.54 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Jan 28 10:14:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.240.37.74
description:
2025-01-28 10:14:19 dovecot_plain authenticator failed for ([1.71.191.42]) [61.240.37.74]:16338: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:15:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Jan 28 10:14:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Jan 28 10:15:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.129.223.132
description:
[2025-01-28 10:15:29 +0100] info [webmaild] 105.129.223.132 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.163.140.142
description:
[2025-01-28 10:15:39 +0100] info [webmaild] 78.163.140.142 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.10
description:
Jan 28 10:15:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-01-28 10:15:17 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:58736: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:15:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.10
description:
2025-01-28 10:15:49 dovecot_login authenticator failed for ([104.241.238.10]) [104.241.238.10]:48605: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-01-28 10:14:55 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:51198: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 28 10:15:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-28 10:15:37 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.132.14.159]:37178: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 28 10:16:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.246.91.53
description:
[2025-01-28 10:16:03 +0100] info [webmaild] 194.246.91.53 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-28 10:16:06 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:49620: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 28 10:16:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
description:
Jan 28 10:16:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Jan 28 10:16:35 ait sshd[3550362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.218.29.245
description:
[2025-01-28 10:15:58 +0100] info [webmaild] 186.218.29.245 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-28 10:16:15 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com (peravily) [131.106.85.205]:40628: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
description:
2025-01-28 10:16:17 dovecot_plain authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:47064: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Jan 28 10:16:34 ait sshd[3550362]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.110.242.193
description:
[2025-01-28 10:17:27 +0100] info [webmaild] 152.110.242.193 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 10:17:18 dovecot_plain authenticator failed for (brade) [65.20.183.209]:48584: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 10:17:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.92.22
description:
[2025-01-28 10:18:42 +0100] info [webmaild] 45.237.92.22 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.242.20.173
description:
[2025-01-28 10:18:15 +0100] info [webmaild] 213.242.20.173 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:18:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-28 10:18:57 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:44625: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 28 10:19:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-28 10:19:07 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:22086: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 10:19:30 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (mulbet) [91.56.31.108]:59458: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
description:
Jan 28 10:18:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 28 10:19:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-28 10:19:49 dovecot_plain authenticator failed for (tazing) [93.159.152.6]:49496: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 10:19:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Jan 28 10:20:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 10:20:22 ait sshd[3551743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:20:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-01-28 10:20:20 dovecot_plain authenticator failed for (glecuner) [65.20.155.91]:54588: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 10:20:22 ait sshd[3551746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.22.205
description:
2025-01-28 10:20:50 dovecot_plain authenticator failed for ([211.43.22.205]) [211.43.22.205]:59414: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 10:20:22 ait sshd[3551743]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 10:20:22 ait sshd[3551746]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.22.205
description:
Jan 28 10:20:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.22.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-28 10:21:07 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:50464: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 28 10:21:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 28 10:22:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 10:22:24 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:42046: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 28 10:22:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.224.198
description:
2025-01-28 10:22:44 dovecot_plain authenticator failed for (hostmact) [65.20.224.198]:52031: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-28 10:22:03 dovecot_plain authenticator failed for (adusly) [164.92.243.206]:43526: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:22:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-28 10:22:40 dovecot_plain authenticator failed for (noused) [37.224.119.19]:47490: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
description:
Jan 28 10:22:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.242
description:
Jan 28 10:23:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.242
description:
2025-01-28 10:23:28 dovecot_plain authenticator failed for ([124.115.231.242]) [124.115.231.242]:39305: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.250.220.57
description:
[2025-01-28 10:23:37 +0100] info [webmaild] 152.250.220.57 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:23:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 28 10:23:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-28 10:23:43 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:58424: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 28 10:23:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-28 10:23:35 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com (unwoolangm) [131.106.31.52]:49436: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:24:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 10:24:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.113.155.201
description:
[2025-01-28 10:24:30 +0100] info [webmaild] 196.113.155.201 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 10:24:32 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (synaur) [87.103.126.54]:59133: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:24:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 10:24:01 ait sshd[3553029]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 10:24:01 ait sshd[3553029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.108.123.47
description:
[2025-01-28 10:24:15 +0100] info [webmaild] 190.108.123.47 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.195.236.21
description:
[2025-01-28 10:25:35 +0100] info [webmaild] 186.195.236.21 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.45.58
description:
[2025-01-28 10:25:45 +0100] info [webmaild] 186.233.45.58 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.162.144
description:
[2025-01-28 10:25:07 +0100] info [webmaild] 179.125.162.144 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.198.129
description:
[2025-01-28 10:25:22 +0100] info [webmaild] 168.232.198.129 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:26:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.207.67.153
description:
[2025-01-28 10:26:12 +0100] info [webmaild] 94.207.67.153 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 28 10:26:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-28 10:26:23 dovecot_plain authenticator failed for (macks) [2.110.10.192]:59828: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.153.155.245
description:
[2025-01-28 10:27:25 +0100] info [webmaild] 103.153.155.245 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.20.117.0
description:
[2025-01-28 10:27:28 +0100] info [webmaild] 157.20.117.0 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Jan 28 10:27:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-01-28 10:27:15 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:35901: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Jan 28 10:27:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-01-28 10:27:24 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:14242: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-01-28 10:28:33 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:57024: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.173.205.27
description:
[2025-01-28 10:27:56 +0100] info [webmaild] 185.173.205.27 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 28 10:28:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-28 10:28:02 dovecot_plain authenticator failed for mail.schindler-statik.at (zoosperous) [80.120.186.246]:50328: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.249.167.244
description:
[2025-01-28 10:28:04 +0100] info [webmaild] 85.249.167.244 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-28 10:28:15 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:58474: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Jan 28 10:28:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.127.134.129
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-28.103.127.134.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 10:27:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 10:27:58 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (sportishes) [91.56.31.108]:59180: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 28 10:28:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.44.130.63
description:
[2025-01-28 10:29:20 +0100] info [webmaild] 181.44.130.63 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 28 10:29:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.226
description:
2025-01-28 10:29:20 dovecot_login authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:52998: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 28 10:29:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 10:29:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-28 10:29:33 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:51588: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-28 10:29:40 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (codoroanx) [92.244.126.105]:39483: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.226
description:
Jan 28 10:29:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.190.142
description:
[2025-01-28 10:29:18 +0100] info [webmaild] 170.246.190.142 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 10:30:08 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (yarluidae) [91.56.31.108]:61648: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.31.113
description:
47.128.31.113 - - [28/Jan/2025:10:29:59 +0100] "GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3 HTTP/2.0" 200 1461 elibrary.ait-edu.us "https://elibrary.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24581316" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.31.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 10:30:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.171
description:
Jan 28 10:30:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.171
description:
2025-01-28 10:30:44 dovecot_plain authenticator failed for (unhal) [65.20.129.171]:47835: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.99.253.248
description:
Jan 28 10:30:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.99.253.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.253.248
description:
2025-01-28 10:30:08 dovecot_plain authenticator failed for host-37-99-253-248.geny.it (weeroy) [37.99.253.248]:57054: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.254.135
description:
[2025-01-28 10:30:22 +0100] info [webmaild] 143.0.254.135 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.250.238.189
description:
Jan 28 10:31:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.250.238.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 28 10:31:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.250.238.189
description:
2025-01-28 10:31:25 dovecot_plain authenticator failed for c83-250-238-189.bredband.tele2.se (amperfort) [83.250.238.189]:55276: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-28 10:31:26 dovecot_plain authenticator failed for (reaming) [154.144.243.93]:51224: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.237.10
description:
Jan 28 10:31:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.237.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
description:
2025-01-28 10:31:30 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:59412: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 28 10:31:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-28 10:31:47 dovecot_plain authenticator failed for (nensesity) [91.234.132.226]:57345: 535 Incorrect authentication data (set_id=eng20a00115y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.33.247.159
description:
2025-01-28 10:32:11 dovecot_plain authenticator failed for 92-33-247-159.customers.ownit.se (setrossite) [92.33.247.159]:41190: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
description:
Jan 28 10:32:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 10:32:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 10:31:57 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (noingthy) [87.103.126.54]:65325: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-28 10:32:03 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:42892: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.33.247.159
description:
Jan 28 10:32:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.33.247.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.80.226
description:
2025-01-28 10:32:15 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:43668: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.177.194
description:
Jan 28 10:31:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 10:31:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.177.194
description:
2025-01-28 10:31:54 dovecot_plain authenticator failed for ([124.115.177.194]) [124.115.177.194]:48749: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 28 10:32:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-28 10:33:44 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:15814: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 28 10:32:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-28 10:32:53 dovecot_plain authenticator failed for (ocifor) [37.224.119.19]:36394: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.34.26
description:
2025-01-28 10:33:25 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:33039: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-28 10:33:35 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.138]:42632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
description:
Jan 28 10:33:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 28 10:33:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 28 10:33:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 28 10:33:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.181.195.26
description:
Jan 28 10:33:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.181.195.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.195.26
description:
2025-01-28 10:33:11 dovecot_login authenticator failed for (5.181.195.26.customer.sinergiatel.it) [5.181.195.26]:48196: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 28 10:33:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-28 10:33:16 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (sozooness) [195.159.217.71]:58242: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 28 10:34:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-28 10:34:35 dovecot_plain authenticator failed for (umammut) [91.116.42.218]:44614: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-28 10:33:54 dovecot_plain authenticator failed for (brined) [62.231.31.86]:37979: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-28 10:34:03 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:39113: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 10:34:21 ait sshd[3557277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 28 10:33:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 28 10:33:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 28 10:34:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-28 10:33:54 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:28706: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-28 10:34:05 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:54571: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 10:34:21 ait sshd[3557277]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-28 10:34:26 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (omatests) [81.16.170.117]:50000: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.192.19.188
description:
[2025-01-28 10:34:32 +0100] info [webmaild] 177.192.19.188 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.93
description:
Jan 28 10:34:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 28 10:34:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 28 10:35:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 28 10:35:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-28 10:35:47 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:39172: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.188.118.200
description:
[2025-01-28 10:36:49 +0100] info [webmaild] 177.188.118.200 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 28 10:35:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 28 10:36:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-28 10:36:11 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:32978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.220
description:
2025-01-28 10:36:23 dovecot_plain authenticator failed for (pelimpan) [65.20.253.220]:55042: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-28 10:36:32 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:50166: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.207.227.147
description:
[2025-01-28 10:36:10 +0100] info [webmaild] 196.207.227.147 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-28 10:36:40 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:54795: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 10:36:21 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (sectagy) [81.225.30.107]:45201: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.120.66.46
description:
[2025-01-28 10:36:25 +0100] info [webmaild] 79.120.66.46 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Jan 28 10:35:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Jan 28 10:35:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-01-28 10:36:00 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:45010: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 28 10:36:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
description:
Jan 28 10:36:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
description:
2025-01-28 10:36:11 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:54715: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 28 10:36:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-28 10:36:42 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:35760: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 28 10:36:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 28 10:36:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
description:
Jan 28 10:36:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
description:
2025-01-28 10:36:05 dovecot_login authenticator failed for ([110.14.192.20]) [110.14.192.20]:42274: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Jan 28 10:36:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.220
description:
Jan 28 10:36:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-28 10:36:39 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:42208: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 28 10:36:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
description:
2025-01-28 10:35:54 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:51263: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 28 10:36:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-28 10:36:43 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:10431: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-28 10:35:52 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (tridal) [91.200.226.218]:49622: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-28 10:36:01 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:34402: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-28 10:36:05 dovecot_plain authenticator failed for (twing) [154.144.243.93]:56748: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-01-28 10:36:17 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:53664: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 10:36:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 28 10:36:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
description:
2025-01-28 10:36:54 dovecot_login authenticator failed for ([111.61.176.243]) [111.61.176.243]:38706: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.0.16.157
description:
[2025-01-28 10:37:22 +0100] info [webmaild] 206.0.16.157 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.220.146.240
description:
[2025-01-28 10:36:51 +0100] info [webmaild] 95.220.146.240 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 28 10:36:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.84.107.245
description:
2025-01-28 10:37:10 dovecot_login authenticator failed for ([220.84.107.245]) [220.84.107.245]:45916: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-28 10:37:14 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:40976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 28 10:36:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.14.165
description:
[2025-01-28 10:37:10 +0100] info [webmaild] 177.124.14.165 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.84.107.245
description:
Jan 28 10:37:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.84.107.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 28 10:37:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.162
description:
Jan 28 10:37:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-28 10:36:58 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:49146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-28 10:37:01 dovecot_login authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:60086: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.11.106
description:
Jan 28 10:37:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.11.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.11.106
description:
2025-01-28 10:37:19 dovecot_login authenticator failed for (107.11.22.218.broad.static.hf.ah.cndata.com) [218.22.11.106]:42969: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.162
description:
2025-01-28 10:37:42 dovecot_login authenticator failed for p7001163-ipoefx.ipoe.ocn.ne.jp [118.3.227.162]:35994: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-28 10:36:50 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:38820: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 28 10:36:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 10:38:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 10:38:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 28 10:38:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.251.60.128
description:
Jan 28 10:38:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.251.60.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.60.128
description:
2025-01-28 10:38:46 dovecot_login authenticator failed for (128.60.251.198.dynamic.vianetdsl.com) [198.251.60.128]:47229: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 28 10:38:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.96.100.99
description:
Jan 28 10:37:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.96.100.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 10:38:21 dovecot_plain authenticator failed for (ditarted) [46.30.161.197]:51266: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 28 10:38:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:38:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-28 10:38:38 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:28030: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 10:38:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.165.254
description:
[2025-01-28 10:37:50 +0100] info [webmaild] 45.226.165.254 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 10:38:29 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:55651: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
description:
2025-01-28 10:38:44 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:52038: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 28 10:38:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-28 10:38:45 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:44563: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 10:38:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 28 10:38:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.96.100.99
description:
2025-01-28 10:38:01 dovecot_login authenticator failed for ppp-171-96-100-99.revip8.asianet.co.th [171.96.100.99]:40362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-28 10:38:02 dovecot_plain authenticator failed for (redisewres) [164.92.243.206]:36976: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.174.243
description:
Jan 28 10:38:02 ait sshd[3559069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 10:38:11 dovecot_plain authenticator failed for (aclepulip) [109.166.70.166]:52407: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 10:38:15 dovecot_plain authenticator failed for (grecces) [65.20.183.209]:59590: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-01-28 10:38:26 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:49214: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-28 10:38:29 dovecot_login authenticator failed for ([175.210.74.19]) [175.210.74.19]:50866: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-28 10:38:47 dovecot_login authenticator failed for ([14.97.143.225]) [182.71.173.250]:35488: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.42.100
description:
Jan 28 10:38:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.42.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 10:38:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Jan 28 10:38:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
description:
Jan 28 10:38:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-28 10:38:45 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (coadrame) [62.63.230.241]:43672: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 28 10:38:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Jan 28 10:38:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
description:
Jan 28 10:38:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-28 10:39:02 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:42056: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-28 10:39:06 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:36412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
description:
2025-01-28 10:39:43 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (aphamess) [81.243.106.218]:57244: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-01-28 10:38:59 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:45246: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.148.162.59
description:
[2025-01-28 10:39:14 +0100] info [webmaild] 31.148.162.59 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-28 10:39:17 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:55452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-28 10:38:51 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:41044: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-28 10:39:13 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:54764: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 28 10:39:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.140.119.249
description:
[2025-01-28 10:39:39 +0100] info [webmaild] 85.140.119.249 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-28 10:39:42 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:32956: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-28 10:38:53 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:44860: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-28 10:39:05 dovecot_login authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [103.109.44.163]:42380: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 10:39:37 ait sshd[3559636]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.243.106.218
description:
Jan 28 10:39:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.243.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 28 10:38:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 28 10:39:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 28 10:39:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 28 10:39:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 28 10:38:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-28 10:39:01 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:1943: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Jan 28 10:39:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.74.230.193
description:
[2025-01-28 10:39:15 +0100] info [webmaild] 177.74.230.193 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-01-28 10:39:15 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:53766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
description:
2025-01-28 10:38:52 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:51900: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 28 10:39:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 10:39:37 ait sshd[3559636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 28 10:40:05 ait sshd[3560104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 28 10:40:05 ait sshd[3560104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 10:40:15 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (foranes) [81.225.30.107]:35662: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 28 10:40:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-28 10:39:55 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:41151: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 10:40:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-28 10:40:39 dovecot_plain authenticator failed for (wrastergy) [164.92.243.206]:35196: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.135
description:
Jan 28 10:40:46 ait sshd[3560442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 28 10:39:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-28 10:40:04 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:65519: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 10:40:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 28 10:40:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.76.222.116
description:
[2025-01-28 10:40:01 +0100] info [webmaild] 189.76.222.116 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 10:40:11 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:50453: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-28 10:40:16 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:49738: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 28 10:39:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 10:40:36 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (nisan) [109.67.154.24]:54042: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 28 10:40:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.135
description:
Jan 28 10:40:46 ait sshd[3560442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-28 10:40:09 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:45511: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 10:40:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-28 10:39:56 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:34649: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.107.115.203
description:
[2025-01-28 10:40:09 +0100] info [webmaild] 217.107.115.203 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-28 10:40:20 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:57039: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 28 10:40:07 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 28 10:40:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-28 10:41:20 dovecot_login authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:56182: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.174.243
description:
Jan 28 10:41:28 ait sshd[3560635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 10:41:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 124.29.239.111
description:
[2025-01-28 10:41:11 +0100] info [webmaild] 124.29.239.111 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 28 10:41:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.247
description:
2025-01-28 10:41:26 dovecot_login authenticator failed for ([104.241.234.247]) [104.241.234.247]:49230: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 28 10:41:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Jan 28 10:41:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
description:
2025-01-28 10:41:35 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:37089: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 28 10:41:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 28 10:41:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-28 10:41:41 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:56735: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
description:
Jan 28 10:41:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 10:41:44 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:41918: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
description:
2025-01-28 10:41:45 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.247
description:
Jan 28 10:41:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-28 10:41:29 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:48430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
description:
2025-01-28 10:41:30 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:60582: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.109.20.192
description:
Jan 28 10:41:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.109.20.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-28 10:41:50 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:51750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.67.221
description:
[2025-01-28 10:42:11 +0100] info [webmaild] 168.197.67.221 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-28 10:42:11 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:59734: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 28 10:42:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.237.90
description:
Jan 28 10:42:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
description:
2025-01-28 10:42:35 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:41219: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.180
description:
2025-01-28 10:41:57 dovecot_login authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:58324: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-28 10:42:12 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:38348: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 28 10:41:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-28 10:41:59 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:39106: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.142.105.18
description:
Jan 28 10:42:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.142.105.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 28 10:42:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Jan 28 10:42:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.222.184.18
description:
Jan 28 10:42:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.222.184.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.135
description:
Jan 28 10:42:24 ait sshd[3561002]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.135 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.135
description:
Jan 28 10:42:24 ait sshd[3561002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.237.90
description:
2025-01-28 10:42:32 dovecot_plain authenticator failed for (187-50-193-126.customer.tdatabrasil.net.br) [201.28.237.90]:39890: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 10:41:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.180
description:
Jan 28 10:41:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
description:
2025-01-28 10:42:27 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:47010: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 28 10:42:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 28 10:42:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-01-28 10:42:11 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:37466: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.184.18
description:
2025-01-28 10:42:13 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:47108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 10:41:56 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:49743: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
description:
2025-01-28 10:42:19 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (popatic) [188.149.132.246]:49526: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
description:
Jan 28 10:42:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-28 10:43:44 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:39832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-28 10:42:51 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:49406: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Jan 28 10:42:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-01-28 10:43:14 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:57566: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 28 10:43:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.174.243
description:
Jan 28 10:43:07 ait sshd[3561284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
description:
Jan 28 10:43:10 ait sshd[3561284]: Failed password for invalid user ubuntu from 64.227.174.243 port 45026 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 28 10:43:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.135
description:
Jan 28 10:43:43 ait sshd[3561534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-01-28 10:42:55 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:46301: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.135
description:
Jan 28 10:43:43 ait sshd[3561534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.135  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-28 10:43:31 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:43638: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 28 10:43:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-28 10:43:47 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (flastings) [109.164.246.53]:57189: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Jan 28 10:43:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.226.114
description:
2025-01-28 10:43:17 H=(mail.aitedu.net) [165.154.226.114]:61486 F=<ggmvpf@aitedu.net> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 28 10:43:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-28 10:43:43 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:50234: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-01-28 10:44:07 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:42822: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Jan 28 10:44:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.102.233
description:
Jan 28 10:43:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.102.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.102.233
description:
2025-01-28 10:43:59 dovecot_plain authenticator failed for ([183.236.102.233]) [183.236.102.233]:38017: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Jan 28 10:44:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Jan 28 10:44:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.123.47
description:
Jan 28 10:43:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.123.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.123.47
description:
2025-01-28 10:43:58 dovecot_login authenticator failed for (dynamic-adsl.viettel.vn) [27.72.123.47]:45366: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-01-28 10:44:42 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:55345: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 28 10:45:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-28 10:45:10 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:53626: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 10:45:32 ait sshd[3562613]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-01-28 10:45:37 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:60604: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.166.130
description:
2025-01-28 10:45:48 dovecot_plain authenticator failed for 130.sub-166-143-166.myvzw.com [166.143.166.130]:50764: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-28 10:44:58 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:59432: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 10:45:32 ait sshd[3562613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:45:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.224.110
description:
[2025-01-28 10:45:41 +0100] info [webmaild] 27.147.224.110 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.143.166.130
description:
Jan 28 10:45:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.143.166.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-01-28 10:44:52 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:49546: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 28 10:44:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Jan 28 10:45:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
description:
Jan 28 10:46:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
description:
2025-01-28 10:46:37 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:36992: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 28 10:46:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-28 10:46:38 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:42720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-01-28 10:46:00 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:35840: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-28 10:46:13 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:56864: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Jan 28 10:46:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.76
description:
Jan 28 10:46:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
description:
2025-01-28 10:46:16 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:58795: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-28 10:46:28 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:46472: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
description:
Jan 28 10:46:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 28 10:46:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
description:
Jan 28 10:46:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Jan 28 10:45:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.76
description:
2025-01-28 10:46:06 dovecot_login authenticator failed for ([104.241.233.76]) [104.241.233.76]:32874: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 28 10:46:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-01-28 10:46:28 dovecot_plain authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:59987: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
description:
2025-01-28 10:46:44 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:40851: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
description:
2025-01-28 10:46:55 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:56209: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:47:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.193.7
description:
Jan 28 10:47:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.193.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Jan 28 10:47:30 ait sshd[3563348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
description:
Jan 28 10:46:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 28 10:47:05 ait sshd[3563185]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 28 10:47:05 ait sshd[3563185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.193.7
description:
2025-01-28 10:47:12 dovecot_login authenticator failed for ([120.194.193.7]) [120.194.193.7]:38352: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.247
description:
Jan 28 10:47:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Jan 28 10:47:30 ait sshd[3563348]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.247
description:
2025-01-28 10:47:24 dovecot_login authenticator failed for ([104.241.234.247]) [104.241.234.247]:46748: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.201.247.187
description:
[2025-01-28 10:48:49 +0100] info [webmaild] 91.201.247.187 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 28 10:48:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
description:
2025-01-28 10:48:23 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:48671: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
description:
2025-01-28 10:48:35 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:40072: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 28 10:48:47 ait sshd[3563681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 28 10:48:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-28 10:48:12 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:38352: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.51.228
description:
[2025-01-28 10:47:55 +0100] info [webmaild] 177.200.51.228 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-28 10:48:21 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:44090: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.45.11.79
description:
Jan 28 10:48:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.45.11.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 28 10:48:47 ait sshd[3563681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.194.145
description:
[2025-01-28 10:48:10 +0100] info [webmaild] 45.179.194.145 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
description:
Jan 28 10:48:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 28 10:49:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Jan 28 10:49:27 ait sshd[3563967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Jan 28 10:49:27 ait sshd[3563967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 10:49:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.237.119.153
description:
[2025-01-28 10:49:38 +0100] info [webmaild] 212.237.119.153 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-28 10:49:18 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:44066: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-28 10:49:24 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:53331: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 10:49:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 10:49:35 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:56729: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.98.58
description:
[2025-01-28 10:48:58 +0100] info [webmaild] 138.36.98.58 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 28 10:49:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.170.223.39
description:
[2025-01-28 10:49:11 +0100] info [webmaild] 93.170.223.39 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-28 10:49:10 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:54220: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 28 10:49:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 10:49:33 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:41345: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-28 10:50:25 dovecot_login authenticator failed for ([211.107.21.221]) [121.168.116.150]:52309: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 28 10:50:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.141.241.229
description:
Jan 28 10:49:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.141.241.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
description:
2025-01-28 10:49:54 dovecot_login authenticator failed for 229.sub-166-141-241.myvzw.com [166.141.241.229]:57346: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.146.236
description:
[2025-01-28 10:50:17 +0100] info [webmaild] 186.224.146.236 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 28 10:50:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-28 10:50:45 dovecot_login authenticator failed for ([217.32.209.50]) [217.32.209.51]:41054: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 10:51:05 ait sshd[3564855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.225.116.200
description:
[2025-01-28 10:51:46 +0100] info [webmaild] 200.225.116.200 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.82.132.8
description:
[2025-01-28 10:50:52 +0100] info [webmaild] 177.82.132.8 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.101.4
description:
[2025-01-28 10:51:04 +0100] info [webmaild] 186.192.101.4 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 10:51:05 ait sshd[3564855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.171.160
description:
[2025-01-28 10:51:18 +0100] info [webmaild] 177.37.171.160 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-28 10:52:48 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.165.140]:39828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 28 10:52:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-28 10:52:35 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:12982: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 28 10:52:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.226.114
description:
[2025-01-28 10:51:58 +0100] info [webmaild] 168.196.226.114 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.170.48.178
description:
Jan 28 10:53:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.170.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-01-28 10:53:42 dovecot_plain authenticator failed for (anclan) [62.182.116.64]:35056: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.13.139
description:
[2025-01-28 10:53:01 +0100] info [webmaild] 138.219.13.139 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 10:53:15 ait sshd[3565815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 10:53:15 ait sshd[3565815]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Jan 28 10:53:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.48.178
description:
2025-01-28 10:53:44 dovecot_plain authenticator failed for (unify) [188.170.48.178]:43673: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.121.104.153
description:
Jan 28 10:55:01 ait sshd[3566522]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.121.104.153 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.121.104.153
description:
Jan 28 10:55:01 ait sshd[3566522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.121.104.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-28 10:55:09 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (fedefulmon) [62.63.230.241]:42368: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 28 10:55:07 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.202.151
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-55.157.245.202.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.21.140.240
description:
[2025-01-28 10:56:47 +0100] info [webmaild] 177.21.140.240 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:56:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 10:56:52 ait sshd[3567435]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 28 10:57:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-01-28 10:57:38 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:2979: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 28 10:57:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 28 10:57:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 10:57:29 ait sshd[3567684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-28 10:57:49 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.165.140]:54638: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 10:56:52 ait sshd[3567435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:57:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 10:57:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 10:57:29 ait sshd[3567684]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 28 10:57:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-28 10:57:40 dovecot_plain authenticator failed for mail.schindler-statik.at (pudleously) [80.120.186.246]:43442: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-28 10:57:51 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com (josiblidon) [24.168.26.166]:38624: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 28 10:58:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 28 10:58:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-28 10:58:12 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:53138: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.178
description:
2025-01-28 10:58:38 dovecot_plain authenticator failed for 111-70-21-178.emome-ip.hinet.net [111.70.21.178]:49294: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-01-28 10:58:16 dovecot_plain authenticator failed for (estra) [65.20.194.40]:58187: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Jan 28 10:58:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 28 10:58:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-28 10:58:42 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:63964: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 28 10:57:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-01-28 10:57:53 dovecot_plain authenticator failed for (mathes) [65.20.162.187]:57286: 535 Incorrect authentication data (set_id=eng20a00115y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-28 10:58:06 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (reateromer) [2.139.88.148]:45018: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.187
description:
Jan 28 10:57:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.40
description:
Jan 28 10:58:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-28 10:58:44 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:34125: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-28 10:57:53 dovecot_plain authenticator failed for (defierly) [109.108.95.66]:40422: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 10:58:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Jan 28 10:58:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.178.114
description:
2025-01-28 10:58:13 dovecot_plain authenticator failed for (merially) [65.20.178.114]:39525: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.178.114
description:
Jan 28 10:58:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.178.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.178
description:
Jan 28 10:58:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 28 10:58:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 28 10:58:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-28 10:58:33 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:52354: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-28 10:58:44 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:47548: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-28 10:57:58 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:33922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 28 10:58:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-01-28 10:58:14 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:59038: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
description:
2025-01-28 10:58:22 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:51562: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 28 10:57:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-28 10:58:02 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:54456: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-28 10:58:17 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:54022: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 28 10:58:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 10:58:08 dovecot_plain authenticator failed for (suble) [147.235.97.158]:65249: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 28 10:58:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 28 10:59:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-28 10:59:14 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:60041: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.0.112
description:
Jan 28 10:58:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-28 10:58:54 dovecot_login authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:34450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 28 10:58:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.121.104.153
description:
Jan 28 10:59:09 ait sshd[3568275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.121.104.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-28 10:59:38 dovecot_plain authenticator failed for (babless) [77.239.255.163]:43682: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 28 10:58:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 28 10:58:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-28 10:58:57 dovecot_login authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [103.109.44.163]:38466: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.0.112
description:
2025-01-28 10:58:57 dovecot_login authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:44734: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:59:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.24
description:
Jan 28 10:59:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 28 10:58:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-28 10:58:58 dovecot_plain authenticator failed for (unshamil) [149.0.19.108]:34668: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-28 10:58:58 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:13333: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.121.104.153
description:
Jan 28 10:59:09 ait sshd[3568275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.121.104.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.172.24
description:
2025-01-28 10:59:35 dovecot_plain authenticator failed for (triothisma) [65.20.172.24]:58428: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 28 10:59:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.121.104.153
description:
Jan 28 11:00:37 ait sshd[3569037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.121.104.153


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.131.243.139
description:
[2025-01-28 11:00:39 +0100] info [webmaild] 201.131.243.139 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-01-28 11:00:07 dovecot_login authenticator failed for ([120.194.7.10]) [120.194.7.10]:40599: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 11:00:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.121.104.153
description:
Jan 28 11:00:39 ait sshd[3569037]: Failed password for invalid user dde from 188.121.104.153 port 54520 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.251.80.163
description:
[2025-01-28 11:00:44 +0100] info [webmaild] 186.251.80.163 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.254.212.134
description:
[2025-01-28 11:00:47 +0100] info [webmaild] 179.254.212.134 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.77.200.93
description:
[2025-01-28 11:00:16 +0100] info [webmaild] 5.77.200.93 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 28 11:00:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-28 11:00:21 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:52468: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 11:00:33 dovecot_plain authenticator failed for (batious) [65.20.183.209]:54198: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.121.104.153
description:
Jan 28 11:00:37 ait sshd[3569037]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.121.104.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 130.193.219.46
description:
[2025-01-28 10:59:57 +0100] info [webmaild] 130.193.219.46 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.19.170.166
description:
2025-01-28 11:01:34 dovecot_login authenticator failed for ([202.188.165.198]) [210.19.170.166]:59775: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.228
description:
Jan 28 11:01:17 ait dovecot[3471522]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.228, lip=136.243.145.84, TLS, session=<ggIlRsEsLdS594nk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.28.140
description:
[2025-01-28 11:01:18 +0100] info [webmaild] 177.11.28.140 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.19.170.166
description:
Jan 28 11:01:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.19.170.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.124.123
description:
Jan 28 11:02:00 ait sshd[3569763]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.124.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.124.123
description:
Jan 28 11:02:00 ait sshd[3569763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.124.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 11:02:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Jan 28 11:02:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 28 11:02:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 28 11:02:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 11:02:08 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:41984: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.58.230
description:
Jan 28 11:02:48 ait sshd[3570008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.58.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.58.230
description:
Jan 28 11:02:48 ait sshd[3570008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.58.230


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.112.39
description:
[2025-01-28 11:02:34 +0100] info [webmaild] 45.179.112.39 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-01-28 11:02:45 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:51162: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
description:
Jan 28 11:01:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-28 11:02:04 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:5776: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.113.17.222
description:
[2025-01-28 11:02:12 +0100] info [webmaild] 103.113.17.222 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 28 11:02:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.208.15
description:
[2025-01-28 11:02:27 +0100] info [webmaild] 37.236.208.15 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.125.89.62
description:
[2025-01-28 11:02:30 +0100] info [webmaild] 186.125.89.62 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-01-28 11:01:57 dovecot_login authenticator failed for ([121.128.76.108]) [211.196.31.2]:60096: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 28 11:02:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-28 11:02:17 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:60193: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-28 11:02:22 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:55080: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.159.218
description:
2025-01-28 11:03:10 dovecot_plain authenticator failed for ([221.224.159.220]) [221.224.159.218]:38256: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
description:
2025-01-28 11:03:25 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:39551: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
description:
Jan 28 11:03:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-28 11:03:29 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:51632: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 28 11:02:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.159.218
description:
Jan 28 11:03:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.159.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 28 11:03:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-28 11:03:10 dovecot_login authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:55344: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.79.38
description:
2025-01-28 11:03:20 dovecot_login authenticator failed for ([211.178.79.38]) [211.178.79.38]:49223: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 28 11:03:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.134.122
description:
[2025-01-28 11:03:41 +0100] info [webmaild] 179.125.134.122 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-28 11:02:57 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:49751: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-28 11:03:17 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:52584: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.79.38
description:
Jan 28 11:03:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.79.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.149.83.62
description:
Jan 28 11:03:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.149.83.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 28 11:03:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-01-28 11:03:30 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:47710: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
description:
Jan 28 11:03:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 28 11:03:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
description:
2025-01-28 11:03:26 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:42791: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-28 11:03:35 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:40227: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
description:
2025-01-28 11:03:39 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:41767: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
description:
Jan 28 11:03:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 11:04:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.151.77
description:
[2025-01-28 11:04:05 +0100] info [webmaild] 158.181.151.77 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
description:
2025-01-28 11:03:55 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:49170: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 11:04:04 dovecot_plain authenticator failed for (supplince) [147.235.97.158]:28879: 535 Incorrect authentication data (set_id=callahan.55116@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:04:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.117.161.9
description:
[2025-01-28 11:04:33 +0100] info [webmaild] 103.117.161.9 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 11:05:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-28 11:04:52 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:52723: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 11:05:02 ait sshd[3570899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.54.18.220
description:
Jan 28 11:05:05 ait sshd[3571230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-28 11:05:27 dovecot_plain authenticator failed for (rocroones) [91.116.42.218]:45454: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 11:05:31 dovecot_plain authenticator failed for (unductylla) [46.30.161.197]:59925: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Jan 28 11:05:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-01-28 11:05:02 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:53742: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 11:05:02 ait sshd[3570899]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.161.188
description:
Jan 28 11:05:48 ait sshd[3571624]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.161.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.161.188
description:
Jan 28 11:05:48 ait sshd[3571624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.161.188  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 28 11:04:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 28 11:05:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.236.21.232
description:
[2025-01-28 11:05:47 +0100] info [webmaild] 179.236.21.232 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.54.18.220
description:
Jan 28 11:05:05 ait sshd[3571230]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.54.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
description:
Jan 28 11:06:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.54.18.220
description:
Jan 28 11:06:39 ait sshd[3571952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.206.193.131
description:
Jan 28 11:06:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.206.193.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.58.230
description:
Jan 28 11:05:52 ait sshd[3571642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.58.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Jan 28 11:06:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Jan 28 11:06:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.58.230
description:
Jan 28 11:05:52 ait sshd[3571642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.58.230


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-01-28 11:06:18 dovecot_plain authenticator failed for ([1.180.230.98]) [1.180.230.98]:59600: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
description:
2025-01-28 11:06:34 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:57387: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.206.193.131
description:
2025-01-28 11:06:43 dovecot_plain authenticator failed for host-37-206-193-131.business.telecomitalia.it [37.206.193.131]:42156: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-01-28 11:06:35 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:54736: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.54.18.220
description:
Jan 28 11:06:39 ait sshd[3571952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.54.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 11:06:59 ait sshd[3572002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.161.188
description:
Jan 28 11:07:43 ait sshd[3572320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.161.188


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.109.164.46
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-07.65.109.164.46


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.58.230
description:
Jan 28 11:07:03 ait sshd[3572023]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.58.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.58.230
description:
Jan 28 11:07:03 ait sshd[3572023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.58.230


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.58.230
description:
Jan 28 11:07:05 ait sshd[3572023]: Failed password for invalid user user from 167.99.58.230 port 46588 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.161.188
description:
Jan 28 11:07:43 ait sshd[3572320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.161.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 11:06:59 ait sshd[3572002]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-28 11:08:35 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:22007: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-28 11:08:46 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:2454: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 28 11:08:06 ait sshd[3572499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.54.18.220
description:
Jan 28 11:08:12 ait sshd[3572515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.54.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.189.68.225
description:
[2025-01-28 11:08:03 +0100] info [webmaild] 103.189.68.225 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 28 11:08:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 28 11:08:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 28 11:08:06 ait sshd[3572499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.20.29.108
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:awadzie@ait.edu.gh||WPU:awadzie@ait.edu.gh||RSV:6.65||T:APACHE||MV:11-08.178.20.29.108


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.54.18.220
description:
Jan 28 11:08:12 ait sshd[3572515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
description:
2025-01-28 11:09:38 dovecot_login authenticator failed for ([122.227.77.118]) [122.227.77.118]:57459: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-28 11:09:37 dovecot_plain authenticator failed for mail.infologic.co.il (ratizi) [85.130.200.51]:51605: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.228.121.220
description:
Jan 28 11:09:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.228.121.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 28 11:09:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-01-28 11:08:56 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:38708: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-28 11:09:04 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:36498: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
description:
Jan 28 11:09:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 28 11:09:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.228.121.220
description:
2025-01-28 11:09:10 dovecot_plain authenticator failed for c-85-228-121-220.bbcust.telenor.se (pronly) [85.228.121.220]:42150: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Jan 28 11:08:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-28 11:10:11 dovecot_login authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:51164: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.161.188
description:
Jan 28 11:10:16 ait sshd[3573293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.161.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.161.188
description:
Jan 28 11:10:16 ait sshd[3573293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.161.188  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.154.199.12
description:
Jan 28 11:10:16 ait sshd[3573316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.154.199.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.154.199.12
description:
Jan 28 11:10:16 ait sshd[3573316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.199.12  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.22.46
description:
2025-01-28 11:10:00 dovecot_login authenticator failed for (187-93-22-46.customer.tdatabrasil.net.br) [187.93.22.46]:44332: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 28 11:10:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.22.46
description:
Jan 28 11:09:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.22.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 28 11:11:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-28 11:11:21 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:49748: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.128.225
description:
Jan 28 11:11:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.128.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.128.225
description:
2025-01-28 11:11:29 dovecot_plain authenticator failed for ([178.46.128.225]) [178.46.128.225]:36797: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 28 11:10:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.124.123
description:
Jan 28 11:10:57 ait sshd[3573673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.124.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-28 11:10:54 dovecot_plain authenticator failed for (forcul) [178.250.191.189]:53318: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.124.123
description:
Jan 28 11:10:57 ait sshd[3573673]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.124.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.93.223
description:
[2025-01-28 11:12:04 +0100] info [webmaild] 45.185.93.223 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.109.95.157
description:
[2025-01-28 11:12:30 +0100] info [webmaild] 103.109.95.157 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
description:
2025-01-28 11:12:42 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:55324: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.88.125.213
description:
[2025-01-28 11:11:59 +0100] info [webmaild] 176.88.125.213 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.32.79
description:
[2025-01-28 11:12:20 +0100] info [webmaild] 190.114.32.79 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
description:
Jan 28 11:12:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.47.146.47
description:
[2025-01-28 11:12:12 +0100] info [webmaild] 212.47.146.47 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.65.166.249
description:
[2025-01-28 11:13:01 +0100] info [webmaild] 196.65.166.249 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:13:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.52.141.112
description:
[2025-01-28 11:13:25 +0100] info [webmaild] 185.52.141.112 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.152.134
description:
[2025-01-28 11:13:41 +0100] info [webmaild] 201.182.152.134 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.219
description:
Jan 28 11:12:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.219
description:
2025-01-28 11:12:54 dovecot_plain authenticator failed for ([60.31.181.219]) [60.31.181.219]:57129: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-28 11:14:24 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:47760: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.124.123
description:
Jan 28 11:14:26 ait sshd[3575123]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.124.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.124.123
description:
Jan 28 11:14:26 ait sshd[3575123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.124.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 28 11:14:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.60.154
description:
Jan 28 11:14:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.60.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-28 11:14:35 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (trootile) [85.69.178.104]:58692: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.221.162
description:
[2025-01-28 11:14:14 +0100] info [webmaild] 201.71.221.162 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 28 11:14:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.60.154
description:
2025-01-28 11:14:35 dovecot_plain authenticator failed for ([220.172.60.154]) [220.172.60.154]:48436: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.4.134
description:
[2025-01-28 11:14:07 +0100] info [webmaild] 37.238.4.134 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-28 11:15:30 dovecot_plain authenticator failed for (sperpike) [91.116.42.218]:45716: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 11:15:48 ait sshd[3575976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-28 11:15:49 dovecot_plain authenticator failed for (eudiser) [102.53.15.18]:38511: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 28 11:15:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.74.66.49
description:
[2025-01-28 11:15:31 +0100] info [webmaild] 105.74.66.49 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 28 11:15:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 11:15:48 ait sshd[3575976]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.15.38.55
description:
[2025-01-28 11:15:59 +0100] info [webmaild] 185.15.38.55 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.236.82.60
description:
[2025-01-28 11:16:06 +0100] info [webmaild] 186.236.82.60 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 11:16:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 11:16:26 dovecot_plain authenticator failed for (upectops) [81.211.77.58]:18367: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.36.207.16
description:
[2025-01-28 11:17:32 +0100] info [webmaild] 191.36.207.16 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:18:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 28 11:18:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-28 11:18:04 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:43654: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 28 11:18:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-28 11:18:18 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:19396: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 28 11:19:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 28 11:19:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-28 11:19:44 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:34456: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.230.162
description:
[2025-01-28 11:19:07 +0100] info [webmaild] 177.200.230.162 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 11:20:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.45.11.79
description:
Jan 28 11:20:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.45.11.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.218.17.45
description:
Jan 28 11:20:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.218.17.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
description:
2025-01-28 11:19:57 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:51659: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 28 11:20:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
description:
2025-01-28 11:20:08 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:37108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
description:
2025-01-28 11:20:40 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:56522: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 28 11:20:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-28 11:20:51 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38512: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-01-28 11:19:53 dovecot_login authenticator failed for ([14.37.79.247]) [14.37.79.247]:40633: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Jan 28 11:20:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
description:
Jan 28 11:19:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 28 11:20:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-28 11:20:19 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:36349: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.218.17.45
description:
2025-01-28 11:20:42 dovecot_login authenticator failed for ([222.218.17.45]) [222.218.17.45]:36110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 28 11:19:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 28 11:19:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 11:21:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 11:21:30 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (raphy) [87.103.126.54]:63282: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 11:21:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 11:21:02 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (churting) [51.255.84.180]:39090: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 28 11:21:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-28 11:21:27 dovecot_plain authenticator failed for (ouning) [102.53.15.17]:36763: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 28 11:21:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 28 11:22:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 28 11:22:04 ait sshd[3579315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
description:
Jan 28 11:22:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
description:
2025-01-28 11:22:12 dovecot_login authenticator failed for ([211.109.93.130]) [211.109.93.130]:33802: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 28 11:22:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
description:
Jan 28 11:22:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-01-28 11:22:35 dovecot_login authenticator failed for ([121.128.76.108]) [211.196.31.2]:40832: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
description:
Jan 28 11:22:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-28 11:22:35 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:36068: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 28 11:22:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.212.68
description:
Jan 28 11:22:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.212.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.248.251
description:
2025-01-28 11:21:58 dovecot_plain authenticator failed for c188-148-248-251.bredband.tele2.se (reareties) [188.148.248.251]:36340: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-28 11:22:00 dovecot_plain authenticator failed for (lastonadic) [93.159.152.6]:38484: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.222.244.89
description:
Jan 28 11:22:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.222.244.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
description:
2025-01-28 11:22:28 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:13882: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.239.109.147
description:
Jan 28 11:22:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.239.109.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.212.68
description:
2025-01-28 11:22:47 dovecot_plain authenticator failed for ([111.39.212.68]) [111.39.212.68]:33346: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.239.109.147
description:
2025-01-28 11:22:48 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:30392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.248.251
description:
Jan 28 11:21:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.248.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-28 11:22:06 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38498: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.222.244.89
description:
2025-01-28 11:22:19 dovecot_login authenticator failed for (89.244.222.60.adsl-pool.sx.cn) [60.222.244.89]:41654: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-28 11:22:46 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:41850: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.217
description:
Jan 28 11:23:05 ait sshd[3579723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.217  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Jan 28 11:23:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 11:23:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.246.138.100
description:
Jan 28 11:23:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.246.138.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-01-28 11:23:46 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:47803: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.202.4
description:
[2025-01-28 11:23:49 +0100] info [webmaild] 37.238.202.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.45.107.20
description:
[2025-01-28 11:23:49 +0100] info [webmaild] 177.45.107.20 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.80.220.155
description:
Jan 28 11:22:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.80.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.96.74.103
description:
[2025-01-28 11:23:46 +0100] info [webmaild] 212.96.74.103 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-28 11:23:26 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:46146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.80.220.155
description:
2025-01-28 11:22:58 dovecot_login authenticator failed for mobile-107-80-220-155.mycingular.net [107.80.220.155]:45781: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 11:23:06 dovecot_plain authenticator failed for (baratoid) [81.211.77.58]:45122: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.140.69
description:
Jan 28 11:23:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.140.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.140.69
description:
2025-01-28 11:23:11 dovecot_plain authenticator failed for (chied) [65.20.140.69]:49135: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.138.100
description:
2025-01-28 11:23:13 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:39888: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 28 11:23:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Jan 28 11:24:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 28 11:24:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-28 11:24:22 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (larymit) [94.45.76.149]:59609: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.30.24
description:
Jan 28 11:24:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.30.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 11:24:44 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (eouse) [91.56.31.108]:60655: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.208.239.68
description:
[2025-01-28 11:23:59 +0100] info [webmaild] 186.208.239.68 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.1.13
description:
[2025-01-28 11:24:05 +0100] info [webmaild] 177.8.1.13 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Jan 28 11:24:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.30.24
description:
2025-01-28 11:24:45 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:50779: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-01-28 11:24:10 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:41869: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.104.44.173
description:
[2025-01-28 11:24:39 +0100] info [webmaild] 5.104.44.173 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 11:24:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-01-28 11:24:44 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:44823: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 28 11:24:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.155
description:
Jan 28 11:24:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
description:
2025-01-28 11:25:07 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:60218: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-28 11:24:54 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:44712: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.21.132.68
description:
[2025-01-28 11:25:01 +0100] info [webmaild] 5.21.132.68 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-01-28 11:25:11 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:47234: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.47.136.121
description:
[2025-01-28 11:25:47 +0100] info [webmaild] 212.47.136.121 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Jan 28 11:25:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.33.32.113
description:
[2025-01-28 11:25:40 +0100] info [webmaild] 102.33.32.113 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 28 11:25:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.155
description:
2025-01-28 11:25:00 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:51676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-28 11:25:02 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (coula) [81.143.51.58]:45076: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
description:
Jan 28 11:25:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.200.92.158
description:
[2025-01-28 11:25:47 +0100] info [webmaild] 103.200.92.158 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
description:
Jan 28 11:26:34 ait sshd[3581717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 11:26:05 ait sshd[3581469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.0.156.128
description:
Jan 28 11:26:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.0.156.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
description:
2025-01-28 11:26:29 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (gnousism) [90.0.156.128]:45126: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.237
description:
Jan 28 11:26:34 ait sshd[3581717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 11:26:05 ait sshd[3581469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.84.177.64
description:
[2025-01-28 11:27:19 +0100] info [webmaild] 189.84.177.64 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:27:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.58.124.145
description:
Jan 28 11:27:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.58.124.145 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.123.193.204
description:
[2025-01-28 11:27:47 +0100] info [webmaild] 94.123.193.204 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.206.101.19
description:
Jan 28 11:27:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.206.101.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.206.101.19
description:
2025-01-28 11:27:13 dovecot_plain authenticator failed for dslb-002-206-101-019.002.206.pools.vodafone-ip.de (subfammog) [2.206.101.19]:45760: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.58.124.145
description:
2025-01-28 11:27:27 dovecot_plain authenticator failed for 176-58-124-145.ip.linodeusercontent.com (perrebeta) [176.58.124.145]:40724: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:26:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Jan 28 11:28:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-01-28 11:28:32 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:50441: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 11:28:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
description:
Jan 28 11:28:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 11:28:48 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (polandist) [87.103.126.54]:17614: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
description:
2025-01-28 11:28:48 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:56156: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.48.65.76
description:
[2025-01-28 11:28:14 +0100] info [webmaild] 200.48.65.76 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
description:
2025-01-28 11:29:35 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:58234: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Jan 28 11:29:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-01-28 11:29:49 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:54050: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
description:
Jan 28 11:29:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.236.142.200
description:
[2025-01-28 11:30:05 +0100] info [webmaild] 87.236.142.200 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.32.122
description:
[2025-01-28 11:30:27 +0100] info [webmaild] 86.108.32.122 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 11:29:52 ait sshd[3583266]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:29:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
description:
2025-01-28 11:30:36 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:40623: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.162.163
description:
[2025-01-28 11:30:26 +0100] info [webmaild] 45.6.162.163 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Jan 28 11:30:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 11:30:42 ait sshd[3584028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 11:30:42 ait sshd[3584028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-01-28 11:30:49 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:40810: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 11:29:52 ait sshd[3583266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
description:
Jan 28 11:30:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 28 11:31:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.6.81.48
description:
Jan 28 11:31:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.6.81.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.6.81.48
description:
2025-01-28 11:31:41 dovecot_login authenticator failed for (48.81.6.185.in-addr.arpa) [185.6.81.48]:33710: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 11:31:46 ait sshd[3584479]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 11:31:46 ait sshd[3584479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-01-28 11:32:22 dovecot_login authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:38466: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Jan 28 11:31:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-01-28 11:31:53 dovecot_login authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:47111: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 28 11:31:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.231.212.78
description:
Jan 28 11:32:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.231.212.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.231.212.78
description:
2025-01-28 11:32:12 dovecot_login authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:62228: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Jan 28 11:32:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.182.174.222
description:
Jan 28 11:33:35 ait sshd[3585452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.182.174.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.182.174.222
description:
Jan 28 11:33:35 ait sshd[3585452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.182.174.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:33:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 28 11:33:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-28 11:33:41 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:51088: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
description:
Jan 28 11:33:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 28 11:33:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
description:
2025-01-28 11:33:53 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:53078: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
description:
Jan 28 11:34:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
description:
2025-01-28 11:34:08 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:18254: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 28 11:34:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-28 11:34:43 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:49710: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-28 11:33:54 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:41959: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
description:
Jan 28 11:35:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 28 11:34:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-28 11:35:24 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:43636: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 28 11:35:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-28 11:34:57 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:28239: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:35:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
description:
2025-01-28 11:35:36 dovecot_plain authenticator failed for ([222.190.110.210]) [222.190.110.210]:33559: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
description:
Jan 28 11:36:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.172.173.17
description:
[2025-01-28 11:36:10 +0100] info [webmaild] 201.172.173.17 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-01-28 11:36:11 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:60728: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.222
description:
Jan 28 11:36:30 ait sshd[3587316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.240.242.52
description:
[2025-01-28 11:36:32 +0100] info [webmaild] 190.240.242.52 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.116.10.206
description:
[2025-01-28 11:36:00 +0100] info [webmaild] 154.116.10.206 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.8.126.222
description:
[2025-01-28 11:36:03 +0100] info [webmaild] 201.8.126.222 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 28 11:36:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-28 11:36:23 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:47416: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.226
description:
Jan 28 11:36:25 ait sshd[3587295]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.226
description:
Jan 28 11:36:25 ait sshd[3587295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.226  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.165.95.231
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:11-35.213.165.95.231


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.62.61.232
description:
[2025-01-28 11:36:00 +0100] info [webmaild] 177.62.61.232 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.222
description:
Jan 28 11:36:30 ait sshd[3587316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.222  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.182.174.222
description:
Jan 28 11:37:03 ait sshd[3587792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.182.174.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 28 11:37:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.127.26
description:
[2025-01-28 11:37:49 +0100] info [webmaild] 37.236.127.26 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 11:37:32 ait sshd[3587918]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-28 11:37:45 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:40288: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.182.174.222
description:
Jan 28 11:37:03 ait sshd[3587792]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.182.174.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:37:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 11:37:32 ait sshd[3587918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.89.135.156
description:
[2025-01-28 11:37:07 +0100] info [webmaild] 189.89.135.156 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.93
description:
Jan 28 11:37:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Jan 28 11:37:36 ait sshd[3588066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.80.117.14
description:
[2025-01-28 11:37:45 +0100] info [webmaild] 41.80.117.14 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:36:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.252.98
description:
[2025-01-28 11:36:54 +0100] info [webmaild] 138.121.252.98 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-28 11:37:32 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:49161: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.218
description:
Jan 28 11:37:36 ait sshd[3588066]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.59.96
description:
[2025-01-28 11:37:59 +0100] info [webmaild] 181.199.59.96 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 28 11:38:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-28 11:38:03 dovecot_login authenticator failed for s2.legionusa.com [159.203.87.228]:44844: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.251.134
description:
2025-01-28 11:38:34 H=(mail.ait-edu.us) [165.154.251.134]:50960 F=<vibbgghckbk@ait-edu.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.218
description:
Jan 28 11:37:53 ait sshd[3588133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.174.222
description:
Jan 28 11:38:24 ait sshd[3588358]: Failed password for invalid user fred from 94.182.174.222 port 38520 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Jan 28 11:37:53 ait sshd[3588133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:38:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 28 11:38:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-28 11:38:42 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:39612: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.237.145
description:
2025-01-28 11:38:18 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.237.145]:32509: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.182.174.222
description:
Jan 28 11:38:22 ait sshd[3588358]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.182.174.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.182.174.222
description:
Jan 28 11:38:22 ait sshd[3588358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.182.174.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:38:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Jan 28 11:39:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.236
description:
Jan 28 11:39:38 ait sshd[3589248]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-28 11:39:45 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:33426: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 28 11:39:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.34.94
description:
[2025-01-28 11:39:38 +0100] info [webmaild] 170.80.34.94 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.202.151
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-39.157.245.202.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 28 11:39:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
description:
Jan 28 11:39:38 ait sshd[3589248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-01-28 11:39:02 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:42903: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-28 11:39:34 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:34936: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.236
description:
Jan 28 11:39:52 ait sshd[3589296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.236 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
description:
Jan 28 11:39:52 ait sshd[3589296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.73.117
description:
2025-01-28 11:40:03 dovecot_plain authenticator failed for ([24.121.73.117]) [24.121.73.117]:48321: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 11:40:48 ait sshd[3590136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.157.201.179
description:
[2025-01-28 11:39:58 +0100] info [webmaild] 177.157.201.179 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.149.215
description:
[2025-01-28 11:40:29 +0100] info [webmaild] 177.37.149.215 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-01-28 11:39:53 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:42408: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.121.73.117
description:
Jan 28 11:40:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.121.73.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 11:40:48 ait sshd[3590136]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Jan 28 11:39:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.2.79
description:
Jan 28 11:40:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.2.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.151
description:
Jan 28 11:40:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.2.79
description:
2025-01-28 11:41:01 dovecot_plain authenticator failed for (j8makiutqzpa1vif5pjszerh2fv2) [77.40.2.79]:18627: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:40:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.252.7
description:
Jan 28 11:41:31 ait sshd[3590472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.252.7  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.151
description:
2025-01-28 11:41:01 dovecot_plain authenticator failed for (x59w80qs8mm8kvxm72o8m5emzsa) [77.40.62.151]:15915: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.150.131
description:
[2025-01-28 11:42:28 +0100] info [webmaild] 45.224.150.131 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:42:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.2.79
description:
Jan 28 11:42:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.2.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.151
description:
Jan 28 11:42:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.2.79
description:
2025-01-28 11:42:43 dovecot_plain authenticator failed for (8euo0s65ab69s9lxem31bvxc9pw) [77.40.2.79]:18245: 535 Incorrect authentication data (set_id=eng19a00082y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.158.241.204
description:
[2025-01-28 11:42:03 +0100] info [webmaild] 105.158.241.204 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.151
description:
2025-01-28 11:42:43 dovecot_plain authenticator failed for (sq6e5q3j8urvy2ho4ima) [77.40.62.151]:14958: 535 Incorrect authentication data (set_id=ads20a00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.232.152
description:
Jan 28 11:43:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.232.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.65.117
description:
2025-01-28 11:43:23 dovecot_login authenticator failed for ([183.238.65.117]) [183.238.65.117]:50981: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.86.60.248
description:
2025-01-28 11:43:27 dovecot_login authenticator failed for (60.86.172.in-addr.arpa) [172.86.60.248]:50348: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.222.84
description:
Jan 28 11:43:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.222.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.222.84
description:
2025-01-28 11:43:45 dovecot_login authenticator failed for ([183.234.222.84]) [183.234.222.84]:60253: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
description:
2025-01-28 11:43:21 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:46819: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.232.152
description:
2025-01-28 11:43:34 dovecot_login authenticator failed for ([104.241.232.152]) [104.241.232.152]:38382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:43:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
description:
Jan 28 11:43:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.65.117
description:
Jan 28 11:43:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.65.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.86.60.248
description:
Jan 28 11:43:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.86.60.248 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.252.7
description:
Jan 28 11:43:56 ait sshd[3591898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.252.7  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 28 11:44:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-28 11:44:05 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:42256: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-28 11:45:37 dovecot_login authenticator failed for ([120.71.199.46]) [120.71.199.46]:55896: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.113
description:
2025-01-28 11:45:05 dovecot_plain authenticator failed for (7tz928xdheqsqefuxkynx) [77.40.62.113]:5025: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 28 11:45:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-28 11:45:23 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:53610: 535 Incorrect authentication data (set_id=sales@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Jan 28 11:45:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.113
description:
Jan 28 11:45:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 28 11:45:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 28 11:45:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.241.161
description:
Jan 28 11:46:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.195.38
description:
Jan 28 11:46:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.195.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
description:
Jan 28 11:46:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-01-28 11:46:10 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:53953: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.241.161
description:
2025-01-28 11:46:32 dovecot_login authenticator failed for p54161-obmd01.osaka.ocn.ne.jp [153.141.241.161]:55219: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.228
description:
Jan 28 11:46:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.228
description:
2025-01-28 11:46:37 dovecot_login authenticator failed for ([114.108.126.228]) [114.108.126.228]:53052: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-28 11:47:40 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:49464: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-28 11:47:48 dovecot_login authenticator failed for ([116.90.97.209]) [116.90.97.209]:35609: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.113
description:
Jan 28 11:46:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.136.252
description:
[2025-01-28 11:47:11 +0100] info [webmaild] 45.228.136.252 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 28 11:47:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.145.233
description:
2025-01-28 11:47:28 dovecot_login authenticator failed for ([110.49.145.233]) [110.49.145.233]:36384: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 28 11:47:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.113
description:
2025-01-28 11:46:57 dovecot_plain authenticator failed for (5bvndc1c5jwn90h9lkop) [77.40.62.113]:18171: 535 Incorrect authentication data (set_id=eng19a00082y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.107.0.188
description:
Jan 28 11:47:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.107.0.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.107.0.188
description:
2025-01-28 11:47:07 dovecot_login authenticator failed for ([218.107.0.188]) [218.107.0.188]:58597: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 28 11:47:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-28 11:47:38 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:35997: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Jan 28 11:47:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.39.117.146
description:
[2025-01-28 11:47:46 +0100] info [webmaild] 212.39.117.146 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.49.145.233
description:
Jan 28 11:47:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.49.145.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-28 11:47:28 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:52871: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 28 11:47:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-01-28 11:47:40 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:36884: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 11:47:54 ait sshd[3595008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.135.193
description:
[2025-01-28 11:47:55 +0100] info [webmaild] 157.100.135.193 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.147.171.132
description:
[2025-01-28 11:47:57 +0100] info [webmaild] 197.147.171.132 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
description:
Jan 28 11:48:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 28 11:48:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
description:
2025-01-28 11:48:31 dovecot_login authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:57964: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
description:
2025-01-28 11:48:41 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:47350: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.253
description:
Jan 28 11:47:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-28 11:48:32 dovecot_login authenticator failed for ([58.216.101.162]) [58.216.101.162]:51666: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-01-28 11:48:39 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:54718: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
description:
Jan 28 11:48:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.253
description:
2025-01-28 11:47:59 dovecot_login authenticator failed for ([112.102.48.253]) [112.102.48.253]:41652: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Jan 28 11:48:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-01-28 11:48:18 dovecot_login authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:43166: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.179.9
description:
[2025-01-28 11:48:23 +0100] info [webmaild] 45.173.179.9 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
description:
2025-01-28 11:48:28 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:65101: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
description:
Jan 28 11:48:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.186.253.77
description:
[2025-01-28 11:48:42 +0100] info [webmaild] 91.186.253.77 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 11:47:54 ait sshd[3595008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.71.195
description:
Jan 28 11:48:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.71.195
description:
2025-01-28 11:48:20 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.71.195]:42640: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Jan 28 11:48:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.224.134
description:
[2025-01-28 11:48:57 +0100] info [webmaild] 37.40.224.134 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 28 11:49:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.138
description:
Jan 28 11:49:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 28 11:49:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Jan 28 11:48:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-01-28 11:49:49 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:41184: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Jan 28 11:49:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.223.168.193
description:
Jan 28 11:49:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.223.168.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
description:
Jan 28 11:49:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:49:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.5.148
description:
[2025-01-28 11:49:40 +0100] info [webmaild] 179.108.5.148 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-28 11:49:46 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:50422: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-01-28 11:49:01 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:36095: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.210.49
description:
Jan 28 11:49:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.210.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-28 11:49:31 dovecot_login authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:49630: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.180.120
description:
2025-01-28 11:49:32 dovecot_login authenticator failed for ([180.7.180.120]) [180.7.180.120]:46863: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:49:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.230
description:
Jan 28 11:49:45 ait sshd[3595919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 28 11:48:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-28 11:48:54 dovecot_login authenticator failed for ([41.93.113.138]) [41.93.113.138]:36816: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
description:
Jan 28 11:49:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-28 11:49:19 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:35362: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-01-28 11:49:20 dovecot_login authenticator failed for ([185.129.114.190]) [185.129.114.190]:49078: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.180.120
description:
Jan 28 11:49:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.180.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
description:
2025-01-28 11:49:32 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:40701: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.138
description:
2025-01-28 11:49:22 dovecot_plain authenticator failed for ([112.91.124.138]) [112.91.124.138]:38377: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.228.112.97
description:
[2025-01-28 11:49:36 +0100] info [webmaild] 88.228.112.97 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.230
description:
Jan 28 11:49:45 ait sshd[3595919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.230  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Jan 28 11:49:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-28 11:49:02 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:40794: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.210.49
description:
2025-01-28 11:49:11 dovecot_plain authenticator failed for (abts-kk-static-49.210.166.122.airtelbroadband.in) [122.166.210.49]:38474: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.42.130.106
description:
[2025-01-28 11:49:29 +0100] info [webmaild] 176.42.130.106 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.47.43
description:
2025-01-28 11:50:20 dovecot_login authenticator failed for ([117.192.47.43]) [117.192.47.43]:47963: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-28 11:50:31 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:39289: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-01-28 11:50:05 dovecot_login authenticator failed for ([103.177.40.85]) [103.177.40.85]:38053: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.20.8.25
description:
Jan 28 11:50:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.20.8.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.219.254
description:
Jan 28 11:49:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.219.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.111
description:
Jan 28 11:49:52 ait sshd[3596093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 28 11:49:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.230
description:
Jan 28 11:49:58 ait sshd[3596143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.230  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Jan 28 11:50:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.67.1
description:
2025-01-28 11:50:05 dovecot_login authenticator failed for (wtl.worldcall.net.pk) [111.88.67.1]:54918: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.249.165
description:
Jan 28 11:50:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.249.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:50:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Jan 28 11:50:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.111
description:
Jan 28 11:49:52 ait sshd[3596093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.219.254
description:
2025-01-28 11:49:53 dovecot_login authenticator failed for ([124.115.219.254]) [124.115.219.254]:57314: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 28 11:49:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.197.201
description:
Jan 28 11:50:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.197.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.244
description:
2025-01-28 11:50:08 dovecot_login authenticator failed for ([123.214.65.244]) [123.214.65.244]:44318: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.20.8.25
description:
2025-01-28 11:50:14 dovecot_login authenticator failed for ([5.20.8.25]) [5.20.8.25]:49140: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.230
description:
Jan 28 11:49:52 ait sshd[3595919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-28 11:50:01 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:58110: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.197.201
description:
2025-01-28 11:50:06 dovecot_login authenticator failed for ([120.82.197.201]) [120.82.197.201]:50946: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:50:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.41.120
description:
Jan 28 11:50:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.41.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.41.120
description:
2025-01-28 11:50:40 dovecot_login authenticator failed for ([185.181.41.120]) [185.181.41.120]:45795: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.244
description:
Jan 28 11:50:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-01-28 11:50:06 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:44479: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.34.84
description:
Jan 28 11:50:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-01-28 11:50:32 dovecot_login authenticator failed for ([101.231.247.210]) [101.231.247.210]:57515: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 28 11:50:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-28 11:49:58 dovecot_login authenticator failed for ([102.221.64.10]) [102.221.64.10]:60126: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
description:
2025-01-28 11:50:16 dovecot_login authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:55064: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.47.43
description:
Jan 28 11:50:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.47.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.249.165
description:
2025-01-28 11:50:22 dovecot_login authenticator failed for ([220.180.249.165]) [220.180.249.165]:60547: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:50:46 dovecot_plain authenticator failed for (f3lc9lc7g3dt4cjrfi3kb2kx) [77.40.3.38]:15719: 535 Incorrect authentication data (set_id=ads20a00036y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:50:54 dovecot_plain authenticator failed for (84v0eet9ma3qebks1m68geldo5) [77.40.3.38]:19246: 535 Incorrect authentication data (set_id=ads20a00036y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.180.143
description:
2025-01-28 11:51:38 dovecot_plain authenticator failed for ([180.7.180.143]) [180.7.180.143]:35133: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
description:
2025-01-28 11:51:50 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:53820: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.180.143
description:
Jan 28 11:51:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.180.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 28 11:51:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.225
description:
Jan 28 11:51:41 ait sshd[3597388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.225  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Jan 28 11:50:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-01-28 11:50:57 dovecot_login authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:59877: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 28 11:51:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.185.156.38
description:
[2025-01-28 11:51:31 +0100] info [webmaild] 46.185.156.38 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
description:
Jan 28 11:51:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-28 11:51:40 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:30751: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.225
description:
Jan 28 11:51:41 ait sshd[3597388]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:50:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.75
description:
[2025-01-28 11:51:37 +0100] info [webmaild] 84.54.72.75 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.246.114
description:
2025-01-28 11:52:35 dovecot_login authenticator failed for ([120.237.246.114]) [120.237.246.114]:52054: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.66.228
description:
[2025-01-28 11:52:36 +0100] info [webmaild] 37.77.66.228 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
description:
Jan 28 11:52:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.246.118.115
description:
Jan 28 11:52:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.246.118.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.83.38.15
description:
Jan 28 11:52:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.83.38.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:52:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:52:42 dovecot_plain authenticator failed for (sfgd19l1u2xzq1uh6oxadkt2p5qiu) [77.40.3.38]:10915: 535 Incorrect authentication data (set_id=eng19a00082y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.214.226
description:
2025-01-28 11:52:46 dovecot_login authenticator failed for (broadband.actcorp.in) [115.245.214.226]:42930: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 28 11:51:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.11.218
description:
Jan 28 11:52:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.11.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.227
description:
Jan 28 11:52:39 ait sshd[3597883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.227  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Jan 28 11:52:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Jan 28 11:51:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-28 11:52:01 dovecot_login authenticator failed for ([37.224.119.19]) [37.224.119.19]:46112: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 28 11:52:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
description:
Jan 28 11:52:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:52:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 28 11:51:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-28 11:51:54 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:59733: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.225
description:
Jan 28 11:51:54 ait sshd[3597577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.225  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.246.114
description:
Jan 28 11:52:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.246.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-01-28 11:52:34 dovecot_login authenticator failed for ([211.252.168.97]) [211.252.168.97]:55732: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.227
description:
Jan 28 11:52:39 ait sshd[3597883]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.225
description:
Jan 28 11:51:54 ait sshd[3597577]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
description:
2025-01-28 11:52:29 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:59174: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.11.218
description:
2025-01-28 11:52:06 dovecot_login authenticator failed for ([187.51.11.218]) [187.51.11.218]:43926: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.83.38.15
description:
2025-01-28 11:52:21 dovecot_login authenticator failed for (50-83-38-15.client.mchsi.com) [50.83.38.15]:43680: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-01-28 11:52:18 dovecot_login authenticator failed for ([179.51.0.170]) [179.51.0.170]:47451: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.225.215.93
description:
[2025-01-28 11:52:21 +0100] info [webmaild] 91.225.215.93 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 11:52:22 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:33556: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
description:
Jan 28 11:52:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-01-28 11:52:01 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:44534: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.246.118.115
description:
2025-01-28 11:52:17 dovecot_plain authenticator failed for nz118l115.bb60246.ctm.net [60.246.118.115]:58264: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.3.38
description:
2025-01-28 11:53:08 dovecot_plain authenticator failed for (40fj92qqe573ckot23) [77.40.3.38]:11907: 535 Incorrect authentication data (set_id=ads20a00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.113.91.98
description:
Jan 28 11:53:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.113.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-28 11:53:37 dovecot_login authenticator failed for ([211.109.75.68]) [211.109.75.69]:51580: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.63.189
description:
Jan 28 11:53:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.63.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.3.38
description:
Jan 28 11:53:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 28 11:53:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.113.91.98
description:
2025-01-28 11:53:23 dovecot_login authenticator failed for ([223.113.91.98]) [223.113.91.98]:34144: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 28 11:55:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-28 11:55:39 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:35581: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
description:
Jan 28 11:54:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.0.69.202
description:
Jan 28 11:55:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.0.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.0.69.202
description:
2025-01-28 11:55:28 dovecot_login authenticator failed for 191-0-69-202.host.telemar.net.br (18980159097.user.veloxzone.com.br) [191.0.69.202]:48671: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 28 11:57:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-28 11:57:40 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:51496: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.219.157
description:
Jan 28 11:57:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.219.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Jan 28 11:57:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
description:
Jan 28 11:58:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 11:58:45 ait sshd[3601259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 11:58:46 ait sshd[3601283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-01-28 11:58:00 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:1236: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 28 11:58:46 ait sshd[3601283]: Invalid user universitypublishing from 116.122.157.193 port 43598


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 11:58:46 ait sshd[3601283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.219.157
description:
2025-01-28 11:57:52 dovecot_login authenticator failed for ([94.205.219.157]) [94.205.219.157]:55973: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.249.2.222
description:
[2025-01-28 11:58:13 +0100] info [webmaild] 94.249.2.222 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
description:
2025-01-28 11:58:24 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:53491: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.151.189.218
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:adom-oduro@ait.edu.gh||WPU:adom-oduro@ait.edu.gh||RSV:6.65||T:APACHE||MV:11-57.193.151.189.218


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 11:58:45 ait sshd[3601259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.114.91
description:
[2025-01-28 11:59:26 +0100] info [webmaild] 213.230.114.91 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.39.66.140
description:
[2025-01-28 11:59:45 +0100] info [webmaild] 187.39.66.140 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.118.31
description:
[2025-01-28 11:59:48 +0100] info [webmaild] 213.230.118.31 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 11:59:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:59:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.139.83.133
description:
[2025-01-28 12:00:16 +0100] info [webmaild] 181.139.83.133 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.125.167.156
description:
[2025-01-28 12:00:24 +0100] info [webmaild] 188.125.167.156 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.251.134
description:
2025-01-28 12:00:36 H=(mail.iric.us) [165.154.251.134]:59610 F=<xffcwm@iric.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.119.81
description:
[2025-01-28 12:01:07 +0100] info [webmaild] 191.5.119.81 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.11.252
description:
[2025-01-28 12:01:15 +0100] info [webmaild] 102.0.11.252 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.84.176
description:
[2025-01-28 12:01:16 +0100] info [webmaild] 143.137.84.176 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.30.223
description:
[2025-01-28 12:01:48 +0100] info [webmaild] 186.158.30.223 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.251.134
description:
2025-01-28 12:01:00 H=(mail.jaster.us) [165.154.251.134]:63982 F=<srgqqakmlvq@jaster.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.28.168
description:
Jan 28 12:01:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.227.28.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 12:02:42 ait sshd[3603401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 12:02:42 ait sshd[3603401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.28.168
description:
2025-01-28 12:01:57 dovecot_plain authenticator failed for ip212-227-28-168.pbiaas.com [212.227.28.168]:61888: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-28 12:03:21 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:36368: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 28 12:03:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
description:
Jan 28 12:03:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
description:
Jan 28 12:03:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
description:
2025-01-28 12:03:02 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:42264: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.18.86
description:
[2025-01-28 12:03:13 +0100] info [webmaild] 168.195.18.86 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
description:
2025-01-28 12:03:45 dovecot_login authenticator failed for ([111.61.177.189]) [111.61.177.189]:13506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.186.8
description:
Jan 28 12:03:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.186.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.186.8
description:
2025-01-28 12:03:12 dovecot_login authenticator failed for ([163.142.186.8]) [163.142.186.8]:43049: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 28 12:03:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.145.20.95
description:
[2025-01-28 12:03:22 +0100] info [webmaild] 177.145.20.95 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-28 12:03:25 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:53032: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.85.6
description:
[2025-01-28 12:03:36 +0100] info [webmaild] 45.181.85.6 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 28 12:03:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-28 12:03:44 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:30252: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-28 12:04:32 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:37700: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 12:03:56 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:53311: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 28 12:04:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 28 12:04:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 12:03:58 ait sshd[3604008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-28 12:03:58 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:36476: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.60.10.125
description:
[2025-01-28 12:04:21 +0100] info [webmaild] 177.60.10.125 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 12:03:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 12:03:58 ait sshd[3604008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-28 12:04:49 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:39940: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 28 12:03:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 12:04:58 ait sshd[3604491]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
description:
2025-01-28 12:05:28 dovecot_plain authenticator failed for ([191.217.137.126]) [191.217.137.126]:34224: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.198
description:
Jan 28 12:05:50 ait sshd[3605450]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.198
description:
Jan 28 12:05:50 ait sshd[3605450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 12:04:58 ait sshd[3604491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
description:
Jan 28 12:05:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
description:
Jan 28 12:05:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
description:
2025-01-28 12:05:40 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:46729: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.233
description:
Jan 28 12:05:45 ait sshd[3605441]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.233
description:
Jan 28 12:05:45 ait sshd[3605441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.233  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.233
description:
Jan 28 12:05:58 ait sshd[3605490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.233  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.48.162.11
description:
[2025-01-28 12:05:59 +0100] info [webmaild] 103.48.162.11 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.198
description:
Jan 28 12:05:54 ait sshd[3605450]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.198
description:
Jan 28 12:06:03 ait sshd[3605527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.233
description:
Jan 28 12:05:53 ait sshd[3605441]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-28 12:08:18 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:54654: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 28 12:08:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Jan 28 12:07:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-01-28 12:07:56 dovecot_plain authenticator failed for ([201.172.170.49]) [201.172.170.49]:37687: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.92.33.198
description:
2025-01-28 12:08:02 dovecot_plain authenticator failed for syn-070-092-033-198.biz.spectrum.com [70.92.33.198]:46690: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.167.139
description:
Jan 28 12:08:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.167.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.167.139
description:
2025-01-28 12:08:16 dovecot_plain authenticator failed for (abts-kk-static-139.167.166.122.airtelbroadband.in) [122.166.167.139]:39386: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 28 12:08:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-28 12:08:49 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:9866: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.46.39
description:
47.128.46.39 - - [28/Jan/2025:12:07:54 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24538878 HTTP/1.1" 302 0 www.aitedu.us "http://www.aitedu.us/spcp/index.php?Itemid=103&option=com_content&view=archive" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.92.33.198
description:
Jan 28 12:08:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.92.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:08:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.58.190
description:
Jan 28 12:09:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.58.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Jan 28 12:09:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.58.190
description:
2025-01-28 12:09:11 dovecot_login authenticator failed for p165190-obmd01.tokyo.ocn.ne.jp [153.141.58.190]:41555: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
description:
2025-01-28 12:09:24 dovecot_login authenticator failed for ([65.76.106.187]) [65.76.106.187]:46800: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
description:
Jan 28 12:09:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
description:
Jan 28 12:09:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
description:
Jan 28 12:09:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Jan 28 12:09:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-01-28 12:09:23 dovecot_login authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:38636: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Jan 28 12:09:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-01-28 12:09:37 dovecot_login authenticator failed for ([115.75.188.242]) [115.75.188.242]:48704: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-28 12:09:38 dovecot_login authenticator failed for ([112.111.61.229]) [112.111.61.229]:43314: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.73
description:
2025-01-28 12:09:42 dovecot_login authenticator failed for ([183.204.41.73]) [183.204.41.73]:35590: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
description:
2025-01-28 12:09:48 dovecot_login authenticator failed for ([178.178.194.151]) [178.178.194.151]:47676: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-01-28 12:09:30 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:54695: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Jan 28 12:09:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
description:
2025-01-28 12:09:35 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (iness) [5.228.154.62]:33512: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 28 12:09:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.73
description:
Jan 28 12:09:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
description:
Jan 28 12:08:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
description:
2025-01-28 12:09:01 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:48094: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.31.93.141
description:
[2025-01-28 12:09:09 +0100] info [webmaild] 194.31.93.141 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-01-28 12:09:13 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:59166: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
description:
Jan 28 12:09:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.247.195
description:
2025-01-28 12:09:58 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:56340: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.247.195
description:
Jan 28 12:09:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.247.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.189.211.114
description:
Jan 28 12:09:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.189.211.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.25
description:
47.128.16.25 - - [28/Jan/2025:12:10:17 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23554344 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
description:
2025-01-28 12:09:51 dovecot_login authenticator failed for ([183.220.247.88]) [183.220.247.88]:34260: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
description:
2025-01-28 12:09:53 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:47664: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-01-28 12:10:05 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:34660: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 12:10:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-01-28 12:10:59 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:44634: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
description:
2025-01-28 12:11:09 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:44306: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.97.200.4
description:
[2025-01-28 12:11:19 +0100] info [webmaild] 102.97.200.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.158.42.151
description:
[2025-01-28 12:12:13 +0100] info [webmaild] 201.158.42.151 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:12:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.207.124
description:
[2025-01-28 12:11:52 +0100] info [webmaild] 45.177.207.124 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.178.30.21
description:
[2025-01-28 12:11:58 +0100] info [webmaild] 190.178.30.21 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.136.186.132
description:
[2025-01-28 12:12:10 +0100] info [webmaild] 178.136.186.132 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.201.255.96
description:
[2025-01-28 12:13:41 +0100] info [webmaild] 62.201.255.96 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-28 12:13:47 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:36660: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.43.62.74
description:
[2025-01-28 12:12:58 +0100] info [webmaild] 31.43.62.74 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.229.177.118
description:
[2025-01-28 12:13:00 +0100] info [webmaild] 196.229.177.118 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.220.96.139
description:
[2025-01-28 12:13:03 +0100] info [webmaild] 197.220.96.139 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 12:13:19 ait sshd[3609976]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 12:13:19 ait sshd[3609976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
description:
2025-01-28 12:13:48 dovecot_login authenticator failed for (17.54.gonzagatelecom.com.br) [177.128.54.17]:37008: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Jan 28 12:14:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 28 12:13:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.141.34.41
description:
[2025-01-28 12:14:49 +0100] info [webmaild] 200.141.34.41 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-01-28 12:14:34 dovecot_login authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:48649: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-01-28 12:13:55 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:53515: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-28 12:14:00 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:51382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.33.71
description:
47.128.33.71 - - [28/Jan/2025:12:14:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8920867 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/info.php?id=98" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Jan 28 12:13:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-01-28 12:14:14 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:45742: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.104.126
description:
[2025-01-28 12:15:04 +0100] info [webmaild] 157.100.104.126 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.255.159
description:
[2025-01-28 12:15:12 +0100] info [webmaild] 45.169.255.159 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-01-28 12:14:56 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:54622: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.144.175.201
description:
[2025-01-28 12:15:01 +0100] info [webmaild] 217.144.175.201 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-28 12:15:03 dovecot_plain authenticator failed for (unthypters) [65.20.205.197]:43639: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:15:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
description:
2025-01-28 12:15:10 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:33186: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
description:
2025-01-28 12:16:28 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:46211: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:16:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-01-28 12:16:38 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:44492: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.228
description:
Jan 28 12:16:07 ait sshd[3611640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.228  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.62.47.13
description:
[2025-01-28 12:16:47 +0100] info [webmaild] 189.62.47.13 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.228
description:
Jan 28 12:16:07 ait sshd[3611640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-01-28 12:17:39 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:56971: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
description:
2025-01-28 12:17:48 dovecot_plain authenticator failed for (becatra) [65.20.148.165]:50769: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.119.109
description:
[2025-01-28 12:17:49 +0100] info [webmaild] 128.201.119.109 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.77.197
description:
2025-01-28 12:17:27 dovecot_plain authenticator failed for 37.150.77.197.dynamic.telecom.kz [37.150.77.197]:58605: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Jan 28 12:17:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.165
description:
Jan 28 12:17:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-28 12:18:15 dovecot_plain authenticator failed for ([5.189.118.24]) [5.189.118.24]:38408: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:18:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-01-28 12:18:05 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:42762: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.28.168
description:
Jan 28 12:19:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.227.28.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.28.168
description:
2025-01-28 12:19:33 dovecot_plain authenticator failed for ip212-227-28-168.pbiaas.com [212.227.28.168]:65097: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 200.105.141.150
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-19.200.105.141.150


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Jan 28 12:19:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-01-28 12:19:19 dovecot_plain authenticator failed for (miterce) [65.20.160.195]:55217: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 12:19:31 dovecot_plain authenticator failed for (chnuings) [147.235.97.158]:30953: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.220.47
description:
[2025-01-28 12:20:29 +0100] info [webmaild] 168.195.220.47 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 28 12:20:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-28 12:20:35 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:49962: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 28 12:20:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-01-28 12:20:24 dovecot_plain authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:62736: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.28.168
description:
2025-01-28 12:22:22 dovecot_login authenticator failed for ip212-227-28-168.pbiaas.com [212.227.28.168]:65097: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.40.56
description:
[2025-01-28 12:23:01 +0100] info [webmaild] 187.183.40.56 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.93.252.152
description:
[2025-01-28 12:23:30 +0100] info [webmaild] 178.93.252.152 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.140.80.187
description:
[2025-01-28 12:23:46 +0100] info [webmaild] 190.140.80.187 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 12:23:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 12:23:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.14.251
description:
[2025-01-28 12:24:10 +0100] info [webmaild] 170.244.14.251 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 12:24:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (gluslic) [87.103.126.54]:52358: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.58.74.176
description:
[2025-01-28 12:24:25 +0100] info [webmaild] 103.58.74.176 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 12:24:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 12:24:01 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (kazooele) [51.255.84.180]:58300: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 12:24:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Jan 28 12:24:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.187.69.233
description:
[2025-01-28 12:24:42 +0100] info [webmaild] 78.187.69.233 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.38.37.217
description:
[2025-01-28 12:24:42 +0100] info [webmaild] 92.38.37.217 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.204.78.108
description:
[2025-01-28 12:24:43 +0100] info [webmaild] 156.204.78.108 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-01-28 12:24:44 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:43332: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 12:24:51 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:60294: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 12:25:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 12:25:40 dovecot_plain authenticator failed for (preetal) [109.166.70.166]:37359: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 28 12:24:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 28 12:24:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-28 12:25:00 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:44484: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-28 12:25:40 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:33938: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
description:
Jan 28 12:24:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
description:
2025-01-28 12:24:59 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:36437: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-28 12:25:01 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:50916: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Jan 28 12:25:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-01-28 12:25:11 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:47854: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.109.36
description:
[2025-01-28 12:25:22 +0100] info [webmaild] 157.100.109.36 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
description:
Jan 28 12:25:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.167.114.221
description:
Jan 28 12:25:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.167.114.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 28 12:25:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 28 12:26:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 12:26:20 ait sshd[3617944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Jan 28 12:26:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-01-28 12:25:54 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:58354: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 12:26:20 ait sshd[3617944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-28 12:26:20 dovecot_plain authenticator failed for (tressiver) [185.65.238.250]:48003: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-01-28 12:26:48 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:55881: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.6.61
description:
[2025-01-28 12:26:44 +0100] info [webmaild] 177.86.6.61 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Jan 28 12:25:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 59.153.18.226
description:
[2025-01-28 12:26:15 +0100] info [webmaild] 59.153.18.226 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Jan 28 12:26:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-01-28 12:26:38 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:38423: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 28 12:26:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.165
description:
Jan 28 12:27:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 12:26:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 28 12:26:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.10.21
description:
[2025-01-28 12:27:05 +0100] info [webmaild] 132.255.10.21 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 28 12:28:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 28 12:29:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:29:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 12:29:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.186.156.29
description:
[2025-01-28 12:29:36 +0100] info [webmaild] 213.186.156.29 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 28 12:28:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.184.10
description:
[2025-01-28 12:28:54 +0100] info [webmaild] 186.192.184.10 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
description:
47.128.96.165 - - [28/Jan/2025:12:30:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19936819 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=275" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.232
description:
Jan 28 12:30:39 ait sshd[3620451]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.232
description:
Jan 28 12:30:39 ait sshd[3620451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.232  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.232
description:
Jan 28 12:30:52 ait sshd[3620584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.232  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 12:31:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.232
description:
Jan 28 12:30:52 ait sshd[3620584]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.203.164.83
description:
[2025-01-28 12:31:25 +0100] info [webmaild] 91.203.164.83 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Jan 28 12:31:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.23.73
description:
[2025-01-28 12:31:26 +0100] info [webmaild] 131.255.23.73 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-01-28 12:31:36 dovecot_login authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:61310: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.150.77.197
description:
Jan 28 12:31:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.150.77.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.77.197
description:
2025-01-28 12:31:47 dovecot_login authenticator failed for 37.150.77.197.dynamic.telecom.kz [37.150.77.197]:55999: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 12:32:46 ait sshd[3621915]: Invalid user drapeaux-shop.com 2a00 from 111.231.56.128 port 45456


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 12:32:46 ait sshd[3621915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.216
description:
Jan 28 12:32:09 ait sshd[3621485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.216 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.216
description:
Jan 28 12:32:09 ait sshd[3621485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.216  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 12:32:46 ait sshd[3621915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:33:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
description:
2025-01-28 12:34:27 dovecot_plain authenticator failed for ([74.203.86.207]) [74.203.86.207]:57512: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Jan 28 12:34:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Jan 28 12:33:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 12:34:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.203.86.207
description:
Jan 28 12:34:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.203.86.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
description:
2025-01-28 12:34:31 dovecot_plain authenticator failed for ([36.154.134.146]) [36.154.134.146]:37595: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.218.198
description:
[2025-01-28 12:34:43 +0100] info [webmaild] 45.6.218.198 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-28 12:34:12 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:2111: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.134.146
description:
Jan 28 12:34:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.134.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 12:34:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-01-28 12:34:50 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:57350: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 12:34:07 dovecot_plain authenticator failed for (fandifiess) [147.235.97.158]:61087: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 28 12:34:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-01-28 12:34:37 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:63240: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.157.126
description:
Jan 28 12:34:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.157.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.157.126
description:
2025-01-28 12:34:40 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:48275: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Jan 28 12:34:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-01-28 12:33:56 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:41630: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.152.3
description:
2025-01-28 12:34:56 dovecot_login authenticator failed for ([120.197.152.3]) [120.197.152.3]:51145: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 28 12:35:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
description:
Jan 28 12:35:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 28 12:35:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 28 12:35:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.8
description:
Jan 28 12:34:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 28 12:35:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-01-28 12:35:05 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:59090: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Jan 28 12:35:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.152.3
description:
Jan 28 12:34:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.152.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-28 12:35:11 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:45647: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 207.248.125.171
description:
[2025-01-28 12:35:22 +0100] info [webmaild] 207.248.125.171 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 12:35:24 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:41462: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-28 12:35:40 dovecot_login authenticator failed for ([27.71.27.81]) [27.71.27.81]:43535: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 12:34:52 dovecot_plain authenticator failed for (gatis) [81.211.77.58]:1124: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-28 12:35:36 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:35006: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.185.227.180
description:
[2025-01-28 12:35:30 +0100] info [webmaild] 46.185.227.180 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 28 12:35:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.8
description:
2025-01-28 12:34:55 dovecot_login authenticator failed for 111-70-19-8.emome-ip.hinet.net [111.70.19.8]:40987: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 28 12:35:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
description:
2025-01-28 12:35:40 dovecot_login authenticator failed for ([60.31.181.52]) [60.31.181.52]:49380: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 28 12:36:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-28 12:36:03 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:20302: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
description:
Jan 28 12:36:17 ait sshd[3624249]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Jan 28 12:35:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
description:
Jan 28 12:35:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
description:
2025-01-28 12:35:58 dovecot_login authenticator failed for ([221.146.186.122]) [221.146.186.122]:44270: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Jan 28 12:35:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 12:36:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 28 12:36:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
description:
Jan 28 12:36:17 ait sshd[3624249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.26.136.128
description:
[2025-01-28 12:36:19 +0100] info [webmaild] 197.26.136.128 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:36:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.227.34
description:
[2025-01-28 12:35:55 +0100] info [webmaild] 168.196.227.34 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-01-28 12:36:00 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:55041: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.135.108.74
description:
[2025-01-28 12:36:31 +0100] info [webmaild] 185.135.108.74 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.252.225.185
description:
[2025-01-28 12:36:33 +0100] info [webmaild] 87.252.225.185 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-01-28 12:35:53 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:44330: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.134
description:
[2025-01-28 12:36:27 +0100] info [webmaild] 84.54.71.134 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-01-28 12:36:54 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:35604: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.190.122.254
description:
[2025-01-28 12:37:14 +0100] info [webmaild] 78.190.122.254 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-28 12:37:15 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:32771: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.151.177
description:
Jan 28 12:37:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.151.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 28 12:37:15 ait sshd[3624717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Jan 28 12:36:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 12:36:57 ait sshd[3624640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=sshd


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.14.122
description:
Jan 28 12:36:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 28 12:37:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 28 12:37:15 ait sshd[3624717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.151.177
description:
2025-01-28 12:37:19 dovecot_plain authenticator failed for p242177-obmd01.tokyo.ocn.ne.jp [153.141.151.177]:38773: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 12:36:57 ait sshd[3624640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Jan 28 12:37:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.30.14.122
description:
2025-01-28 12:37:01 dovecot_login authenticator failed for ([185.30.14.122]) [185.30.14.122]:43807: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 12:37:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 137.59.144.137
description:
[2025-01-28 12:36:54 +0100] info [webmaild] 137.59.144.137 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-01-28 12:37:27 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:46762: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-01-28 12:38:10 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:42595: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.62.136.16
description:
[2025-01-28 12:38:35 +0100] info [webmaild] 167.62.136.16 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
description:
Jan 28 12:37:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
description:
2025-01-28 12:37:56 dovecot_login authenticator failed for ([123.118.9.75]) [123.118.9.59]:45156: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Jan 28 12:38:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.161.117.18
description:
[2025-01-28 12:38:48 +0100] info [webmaild] 187.161.117.18 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 12:39:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.73.75.82
description:
Jan 28 12:40:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.73.75.82 has been locked due to Imunify RBL


