# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Jan 27 17:35:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 27 17:35:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-27 17:35:33 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:56516: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.172
description:
2025-01-27 17:35:46 dovecot_plain authenticator failed for ([112.28.128.172]) [112.28.128.172]:56657: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 27 17:35:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.34
description:
2025-01-27 17:36:08 dovecot_plain authenticator failed for ([42.180.162.34]) [42.180.162.34]:42327: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-01-27 17:36:09 dovecot_login authenticator failed for ([50.224.22.135]) [50.224.22.135]:50021: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-01-27 17:36:28 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:55280: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 17:36:29 ait sshd[3103992]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 27 17:36:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 27 17:36:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.92.33.198
description:
Jan 27 17:36:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.92.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.34
description:
Jan 27 17:36:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-01-27 17:36:19 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:41818: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-01-27 17:36:19 dovecot_plain authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:20137: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-27 17:36:57 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:45460: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-27 17:36:07 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:43356: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Jan 27 17:36:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Jan 27 17:36:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 27 17:36:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
description:
Jan 27 17:36:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.92.33.198
description:
2025-01-27 17:36:17 dovecot_plain authenticator failed for syn-070-092-033-198.biz.spectrum.com [70.92.33.198]:49705: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Jan 27 17:36:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
description:
2025-01-27 17:36:28 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:47768: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-27 17:36:45 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:35806: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Jan 27 17:36:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-27 17:36:06 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:45172: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-01-27 17:36:08 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:56396: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 27 17:36:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Jan 27 17:36:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-27 17:36:17 dovecot_plain authenticator failed for ([116.114.84.242]) [116.114.84.242]:49696: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 17:36:29 ait sshd[3103992]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 27 17:36:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-01-27 17:37:26 dovecot_plain authenticator failed for (200151009074.userdial.telemar.net.br) [200.151.9.74]:44493: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.98.167
description:
Jan 27 17:37:29 ait sshd[3104741]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.98.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 17:37:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.137.112.251
description:
Jan 27 17:37:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.137.112.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Jan 27 17:37:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.225.68.108
description:
Jan 27 17:37:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.225.68.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Jan 27 17:37:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 27 17:37:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-27 17:37:42 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:37064: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.224.233
description:
2025-01-27 17:37:43 dovecot_login authenticator failed for ([220.189.239.206]) [61.130.224.233]:44338: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.40
description:
Jan 27 17:37:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.225.68.108
description:
2025-01-27 17:37:59 dovecot_plain authenticator failed for 90-225-68-108-no2666.tbcn.telia.com [90.225.68.108]:58168: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.40
description:
2025-01-27 17:37:55 dovecot_login authenticator failed for ([104.241.228.40]) [104.241.228.40]:36598: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.219
description:
Jan 27 17:37:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.219
description:
2025-01-27 17:37:05 dovecot_login authenticator failed for ([60.31.181.219]) [60.31.181.219]:51952: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-01-27 17:37:19 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:5501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.98.167
description:
Jan 27 17:37:29 ait sshd[3104741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.98.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.137.112.251
description:
2025-01-27 17:37:56 dovecot_login authenticator failed for (abts-mum-static-007.14.170.122.airtelbroadband.in) [103.137.112.251]:34556: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.130.224.233
description:
Jan 27 17:37:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.130.224.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 17:37:54 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:33380: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-01-27 17:38:29 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:57716: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.204.162.110
description:
Jan 27 17:38:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.204.162.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.120.6
description:
Jan 27 17:38:22 ait sshd[3105343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 196.0.120.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.0.120.6
description:
Jan 27 17:38:22 ait sshd[3105343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.0.120.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 27 17:38:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Jan 27 17:38:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Jan 27 17:38:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-27 17:38:29 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:57796: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.162
description:
2025-01-27 17:38:08 dovecot_login authenticator failed for p7001163-ipoefx.ipoe.ocn.ne.jp [118.3.227.162]:37784: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.204.162.110
description:
2025-01-27 17:38:18 dovecot_plain authenticator failed for ([218.204.162.110]) [218.204.162.110]:44088: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-27 17:38:21 dovecot_plain authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:53232: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 27 17:38:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-27 17:38:25 dovecot_login authenticator failed for ([60.223.252.57]) [60.223.252.57]:57958: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Jan 27 17:38:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-01-27 17:38:30 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:34024: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.162
description:
Jan 27 17:38:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/css/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 27 17:38:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-27 17:38:12 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:35656: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-01-27 17:38:16 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:41190: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 27 17:38:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.98.167
description:
Jan 27 17:39:02 ait sshd[3105795]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.98.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.98.167
description:
Jan 27 17:39:02 ait sshd[3105795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.98.167


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.98.167
description:
Jan 27 17:39:04 ait sshd[3105795]: Failed password for invalid user user from 178.128.98.167 port 56010 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 27 17:39:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
description:
2025-01-27 17:39:20 dovecot_login authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:40165: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.33.65.203
description:
[2025-01-27 17:39:21 +0100] info [webmaild] 189.33.65.203 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.143.246
description:
Jan 27 17:39:27 ait sshd[3106119]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.143.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.143.246
description:
Jan 27 17:39:27 ait sshd[3106119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.143.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 17:39:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-27 17:39:37 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:52663: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/data1/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-27 17:39:52 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:50106: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 27 17:39:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.146.93
description:
[2025-01-27 17:39:01 +0100] info [webmaild] 45.229.146.93 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
description:
Jan 27 17:39:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.202.128
description:
[2025-01-27 17:39:17 +0100] info [webmaild] 191.7.202.128 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 17:39:33 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:39528: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 27 17:39:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-27 17:40:01 dovecot_login authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:52174: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.120.6
description:
Jan 27 17:40:02 ait sshd[3106780]: pam_imunify(sshd:auth): [IM360_RBL] The IP 196.0.120.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Jan 27 17:40:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.0.120.6
description:
Jan 27 17:40:02 ait sshd[3106780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.0.120.6


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/js/js/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.234.69
description:
Jan 27 17:40:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.234.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.234.69
description:
2025-01-27 17:40:20 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:48616: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 17:40:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-01-27 17:40:59 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:23206: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.4.195.146
description:
2025-01-27 17:41:14 dovecot_plain authenticator failed for (ip146.ip-142-4-195.net) [142.4.195.146]:37370: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.210.94.61
description:
Jan 27 17:41:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.210.94.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.210
description:
Jan 27 17:41:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
description:
Jan 27 17:41:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.143.246
description:
Jan 27 17:41:00 ait sshd[3107556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.143.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.246.240.84
description:
Jan 27 17:41:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.246.240.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.62.220.188
description:
[2025-01-27 17:41:16 +0100] info [webmaild] 39.62.220.188 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
description:
2025-01-27 17:41:28 dovecot_plain authenticator failed for ([46.210.94.61]) [46.210.94.61]:46070: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.130.224.233
description:
Jan 27 17:41:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.130.224.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-27 17:41:53 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:65152: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/css/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.246.240.84
description:
2025-01-27 17:41:14 dovecot_login authenticator failed for ([213.246.240.84]) [213.246.240.84]:57742: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.91.165
description:
2025-01-27 17:41:04 dovecot_login authenticator failed for ([65.76.91.165]) [65.76.91.165]:36426: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.210
description:
2025-01-27 17:41:32 dovecot_login authenticator failed for ([195.178.110.210]) [195.178.110.210]:52817: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.143.246
description:
Jan 27 17:41:00 ait sshd[3107556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.143.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.195.146
description:
Jan 27 17:41:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.4.195.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-01-27 17:41:39 dovecot_plain authenticator failed for ([1.183.1.82]) [1.183.1.82]:36401: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.224.233
description:
2025-01-27 17:41:41 dovecot_login authenticator failed for ([220.189.239.206]) [61.130.224.233]:55784: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 27 17:41:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.91.165
description:
Jan 27 17:41:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.91.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 27 17:42:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.228.168.90
description:
Jan 27 17:42:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.228.168.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-27 17:42:39 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:55799: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
description:
2025-01-27 17:42:37 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:54094: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
description:
Jan 27 17:42:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.228.168.90
description:
2025-01-27 17:42:47 dovecot_plain authenticator failed for ([207.228.168.90]) [207.228.168.90]:36664: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-01-27 17:42:49 dovecot_login authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:42749: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/images/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
description:
Jan 27 17:42:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 27 17:43:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.29.34
description:
[2025-01-27 17:43:54 +0100] info [webmaild] 186.249.29.34 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 17:43:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 17:43:49 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:48507: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 27 17:43:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Jan 27 17:43:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Jan 27 17:43:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Jan 27 17:43:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
description:
2025-01-27 17:43:11 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:36342: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 27 17:43:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-01-27 17:43:58 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:35287: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 17:44:00 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:39609: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/css/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 17:43:29 ait sshd[3108954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-01-27 17:43:41 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:53068: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-27 17:43:53 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:44119: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-01-27 17:43:55 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:35378: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 17:43:29 ait sshd[3108954]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.16.248.74
description:
[2025-01-27 17:44:57 +0100] info [webmaild] 103.16.248.74 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.166.202
description:
2025-01-27 17:44:04 dovecot_plain authenticator failed for 202.sub-166-143-166.myvzw.com [166.143.166.202]:36702: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.79.83.28
description:
Jan 27 17:44:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.79.83.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 27 17:44:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-27 17:44:22 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:51596: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-27 17:44:26 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:41919: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.143.166.202
description:
Jan 27 17:44:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.143.166.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 27 17:44:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.79.83.28
description:
2025-01-27 17:44:17 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:38460: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 17:44:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 17:44:47 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:44814: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/css/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-27 17:44:09 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-196.tpgi.com.au) [110.175.220.250]:35271: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 27 17:44:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Jan 27 17:45:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-01-27 17:45:29 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:57126: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 27 17:45:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-01-27 17:45:40 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:43008: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Jan 27 17:45:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-27 17:45:46 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:51104: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-27 17:45:54 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:2976: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.83.38
description:
[2025-01-27 17:45:25 +0100] info [webmaild] 170.78.83.38 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-27 17:45:36 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:39467: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Jan 27 17:45:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 27 17:45:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/data1/images/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.230.179
description:
Jan 27 17:46:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.230.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 27 17:46:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 27 17:46:23 ait sshd[3110857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 27 17:46:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-27 17:46:32 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:43704: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-27 17:46:21 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:35414: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 27 17:46:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.193.41.66
description:
2025-01-27 17:46:40 dovecot_plain authenticator failed for ([141.193.41.66]) [141.193.41.66]:61266: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
description:
2025-01-27 17:46:46 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:50082: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
description:
2025-01-27 17:46:06 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:15563: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.44.162
description:
[2025-01-27 17:46:07 +0100] info [webmaild] 186.192.44.162 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 27 17:46:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 27 17:46:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 17:46:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 27 17:46:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-27 17:47:01 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:43140: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.193.41.66
description:
Jan 27 17:46:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.193.41.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-27 17:46:51 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:52614: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
description:
2025-01-27 17:46:52 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:54984: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.188.18.25
description:
Jan 27 17:46:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.188.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 27 17:46:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-27 17:46:12 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (dershogis) [94.45.76.149]:32980: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-27 17:46:32 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:39476: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Jan 27 17:47:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 27 17:47:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 27 17:47:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 27 17:47:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Jan 27 17:47:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
description:
2025-01-27 17:47:14 dovecot_login authenticator failed for (user-static-94-254-244-211.mobile.play-internet.pl) [94.254.244.211]:38570: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-01-27 17:47:30 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:47214: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
description:
Jan 27 17:47:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
description:
2025-01-27 17:47:10 dovecot_plain authenticator failed for ([222.67.186.253]) [222.67.186.253]:45904: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.11.180
description:
[2025-01-27 17:47:24 +0100] info [webmaild] 177.104.11.180 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-27 17:47:24 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.132.14.159]:47268: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.186.253
description:
Jan 27 17:47:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.186.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-01-27 17:47:17 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:43412: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-01-27 17:47:18 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:36523: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Jan 27 17:47:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 27 17:47:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-27 17:47:40 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:57716: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.250.241
description:
Jan 27 17:47:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.250.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-27 17:47:45 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:65430: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 27 17:47:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
description:
2025-01-27 17:47:03 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:59615: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-27 17:47:05 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:6003: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.254.244.211
description:
Jan 27 17:47:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.254.244.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 27 17:47:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-01-27 17:47:16 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:58434: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/engine1/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-27 17:47:03 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:40328: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.244.68.3
description:
2025-01-27 17:47:15 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:44704: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 27 17:47:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-27 17:47:41 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br (186-247-196-225.user.veloxzone.com.br) [186.247.196.106]:42124: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.250.241
description:
2025-01-27 17:47:46 dovecot_login authenticator failed for ([31.141.250.241]) [31.141.250.241]:41240: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Jan 27 17:47:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.205
description:
Jan 27 17:48:32 ait sshd[3112225]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.205
description:
Jan 27 17:48:32 ait sshd[3112225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.205  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
description:
2025-01-27 17:48:43 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:49293: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
description:
Jan 27 17:48:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
description:
Jan 27 17:48:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Jan 27 17:48:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-01-27 17:48:13 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:32952: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.203
description:
Jan 27 17:48:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.203 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.205
description:
Jan 27 17:48:53 ait sshd[3112225]: error: maximum authentication attempts exceeded for root from 218.92.0.205 port 38822 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-01-27 17:48:11 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:48207: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 27 17:48:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-27 17:48:17 dovecot_login authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:60548: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 27 17:48:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.42.79.74
description:
2025-01-27 17:48:22 dovecot_plain authenticator failed for ([206.42.79.74]) [206.42.79.74]:47282: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-01-27 17:48:05 dovecot_login authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:44068: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/css/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Jan 27 17:48:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
description:
2025-01-27 17:48:51 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:53856: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.203
description:
2025-01-27 17:48:18 dovecot_login authenticator failed for ([104.241.237.203]) [104.241.237.203]:35761: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.42.79.74
description:
Jan 27 17:48:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.42.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-27 17:48:23 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:49230: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
description:
Jan 27 17:48:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 27 17:49:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 27 17:49:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
description:
Jan 27 17:49:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-27 17:49:41 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:53897: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Jan 27 17:49:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-01-27 17:49:51 dovecot_plain authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:46582: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-27 17:49:59 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:37736: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.150.87.70
description:
Jan 27 17:49:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.150.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Jan 27 17:49:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.150.87.70
description:
2025-01-27 17:49:12 dovecot_plain authenticator failed for ([193.150.87.70]) [193.150.87.70]:33666: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Jan 27 17:49:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 27 17:49:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-27 17:50:00 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:52674: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/data1/images/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
description:
2025-01-27 17:49:29 dovecot_plain authenticator failed for ([124.239.169.52]) [124.239.169.52]:59939: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 27 17:49:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Jan 27 17:49:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-01-27 17:49:43 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:45800: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-27 17:49:47 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:60096: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-01-27 17:49:49 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:56561: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-01-27 17:49:58 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:36333: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.232.240.62
description:
[2025-01-27 17:49:04 +0100] info [webmaild] 181.232.240.62 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 27 17:50:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 27 17:50:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Jan 27 17:50:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 27 17:50:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-27 17:50:03 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:45534: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/css/js/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.186.194
description:
[2025-01-27 17:50:12 +0100] info [webmaild] 27.147.186.194 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
description:
2025-01-27 17:50:44 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:40220: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-01-27 17:50:55 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.142.238]:58024: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 17:50:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-27 17:50:23 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:56220: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.119.23.106
description:
2025-01-27 17:50:41 dovecot_login authenticator failed for ([124.119.23.106]) [124.119.23.106]:54583: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.246.240.84
description:
Jan 27 17:50:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.246.240.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Jan 27 17:50:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.246.240.84
description:
2025-01-27 17:50:54 dovecot_login authenticator failed for ([213.246.240.84]) [213.246.240.84]:46019: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.248.232.70
description:
Jan 27 17:50:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.248.232.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Jan 27 17:50:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-01-27 17:50:38 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:55656: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.248.232.70
description:
2025-01-27 17:51:00 dovecot_plain authenticator failed for (static-89-248-232-70.tel.ru) [89.248.232.70]:45378: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-27 17:50:17 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:36240: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.119.23.106
description:
Jan 27 17:50:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.119.23.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-01-27 17:50:15 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:19272: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 27 17:50:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-27 17:51:33 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:49436: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-27 17:51:38 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:60058: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 27 17:51:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.2
description:
2025-01-27 17:51:51 dovecot_plain authenticator failed for ([222.180.2.2]) [222.180.2.2]:52821: 535 Incorrect authentication data (set_id=jpomador)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/css/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
description:
2025-01-27 17:51:11 dovecot_plain authenticator failed for ([45.251.108.124]) [45.251.108.124]:56221: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-27 17:51:47 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:36091: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 27 17:51:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 27 17:51:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.2
description:
Jan 27 17:51:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 27 17:51:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.251.108.124
description:
Jan 27 17:51:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.251.108.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 27 17:51:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-27 17:51:04 dovecot_login authenticator failed for ([37.224.119.19]) [37.224.119.19]:58780: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-27 17:51:54 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:41670: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.9.38.174
description:
Jan 27 17:52:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.9.38.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-27 17:52:35 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:51502: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
description:
2025-01-27 17:52:57 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:47556: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.21.5.139
description:
Jan 27 17:52:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.21.5.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
description:
Jan 27 17:52:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.9.38.174
description:
2025-01-27 17:52:06 dovecot_login authenticator failed for ([76.9.38.174]) [76.9.38.174]:51474: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/engine1/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.21.5.139
description:
2025-01-27 17:52:25 dovecot_login authenticator failed for (dynamic.isp.ooredoo.om) [5.21.5.139]:50180: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
description:
2025-01-27 17:52:50 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:27332: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
description:
Jan 27 17:52:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 27 17:52:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.66.222
description:
Jan 27 17:53:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 27 17:53:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Jan 27 17:53:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.66.222
description:
2025-01-27 17:53:23 dovecot_login authenticator failed for ([94.204.66.222]) [94.204.66.222]:58767: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 27 17:53:07 ait sshd[3115813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/data1/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-27 17:53:36 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:49332: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 27 17:53:07 ait sshd[3115813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-01-27 17:54:00 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:35208: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-27 17:54:21 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:39988: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-27 17:54:34 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:41208: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
description:
Jan 27 17:54:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
description:
2025-01-27 17:54:49 dovecot_plain authenticator failed for ([60.216.37.11]) [60.216.37.11]:56136: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/images/engine1/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-27 17:54:57 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:40232: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 27 17:54:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 27 17:54:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 27 17:54:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 139.135.42.109
description:
[2025-01-27 17:54:24 +0100] info [webmaild] 139.135.42.109 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Jan 27 17:55:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 17:55:04 ait sshd[3117687]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 17:55:04 ait sshd[3117687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-01-27 17:55:07 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:49390: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-27 17:55:51 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:44002: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 17:55:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Jan 27 17:55:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Jan 27 17:55:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-01-27 17:55:41 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:34175: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.161.123
description:
Jan 27 17:56:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.161.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 27 17:56:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 27 17:56:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-27 17:56:22 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:41328: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.161.123
description:
2025-01-27 17:56:27 dovecot_plain authenticator failed for ([93.182.161.123]) [93.182.161.123]:58344: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 17:56:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-27 17:56:08 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:45277: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-27 17:56:56 dovecot_login authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:7401: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 27 17:56:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-27 17:56:47 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:37833: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 27 17:56:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 17:57:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.225.169
description:
2025-01-27 17:57:14 dovecot_login authenticator failed for net-2-37-225-169.cust.vodafonedsl.it [2.37.225.169]:37265: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.9.212.207
description:
[2025-01-27 17:57:45 +0100] info [webmaild] 181.9.212.207 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.225.169
description:
Jan 27 17:57:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.225.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/engine1/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-27 17:58:21 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:54575: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 27 17:58:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/data1/images/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
description:
Jan 27 17:59:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.12.170
description:
Jan 27 17:59:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.12.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 27 17:59:30 ait sshd[3120277]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
description:
2025-01-27 17:59:44 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:53461: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.91.165
description:
2025-01-27 17:59:57 dovecot_login authenticator failed for ([65.76.91.165]) [65.76.91.165]:42730: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
description:
2025-01-27 17:59:57 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:38118: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.33.197
description:
2025-01-27 17:59:12 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.33.197]:62871: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
description:
2025-01-27 17:59:24 dovecot_login authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:47739: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.91.165
description:
Jan 27 17:59:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.91.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
description:
Jan 27 17:59:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/engine1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.33.197
description:
Jan 27 17:59:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.33.197 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 27 17:59:30 ait sshd[3120277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.149.211
description:
Jan 27 18:00:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.149.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
description:
2025-01-27 18:00:24 dovecot_login authenticator failed for (comp148-211.2day.kz) [85.29.149.211]:38178: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/data1/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/engine1/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.141.241.229
description:
Jan 27 18:02:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.141.241.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-27 18:03:47 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:35900: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 27 18:03:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-27 18:03:14 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:47875: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 27 18:03:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
description:
2025-01-27 18:03:00 dovecot_login authenticator failed for 229.sub-166-141-241.myvzw.com [166.141.241.229]:45818: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.252.75.40
description:
[2025-01-27 18:03:04 +0100] info [webmaild] 182.252.75.40 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.109.220.192
description:
[2025-01-27 18:03:46 +0100] info [webmaild] 192.109.220.192 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 27 18:04:10 ait sshd[3123037]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 18:04:25 ait sshd[3123269]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 27 18:04:10 ait sshd[3123037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 18:04:25 ait sshd[3123269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
description:
Jan 27 18:04:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
description:
2025-01-27 18:04:04 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:50264: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/data1/images/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Jan 27 18:05:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 27 18:05:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-27 18:05:20 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:30411: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 27 18:05:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 18:05:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-01-27 18:05:09 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:60098: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-27 18:05:58 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:64163: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-27 18:06:10 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:45391: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.63.203.111
description:
2025-01-27 18:06:30 dovecot_login authenticator failed for lmontsouris-655-1-111-111.w90-63.abo.wanadoo.fr [90.63.203.111]:60258: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Jan 27 18:06:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-27 18:06:40 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:40299: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 27 18:06:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 18:06:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-27 18:06:36 dovecot_login authenticator failed for ([222.186.68.153]) [222.186.68.153]:48758: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 27 18:06:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-01-27 18:06:38 dovecot_login authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:32557: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.135.18.138
description:
2025-01-27 18:06:53 dovecot_login authenticator failed for ([61.135.18.138]) [61.135.18.138]:35030: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 27 18:06:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 18:06:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 18:06:22 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:59177: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.63.203.111
description:
Jan 27 18:06:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.63.203.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.135.18.138
description:
Jan 27 18:06:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.135.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.113.51
description:
[2025-01-27 18:07:31 +0100] info [webmaild] 186.233.113.51 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 18:07:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.222.134.213
description:
[2025-01-27 18:07:16 +0100] info [webmaild] 181.222.134.213 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.146.5
description:
[2025-01-27 18:07:23 +0100] info [webmaild] 45.233.146.5 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-27 18:08:30 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:59400: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.88.10.10
description:
Jan 27 18:08:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.88.10.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/data1/images/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.218.28.118
description:
Jan 27 18:08:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.218.28.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.218.28.118
description:
2025-01-27 18:08:07 dovecot_login authenticator failed for (cpe-c83a353b2048.cpe.cableonda.net) [190.218.28.118]:44650: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 27 18:08:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
description:
2025-01-27 18:08:48 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:37308: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-27 18:09:03 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:64982: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.18.218
description:
[2025-01-27 18:09:24 +0100] info [webmaild] 138.117.18.218 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 27 18:09:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 18:09:55 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:60212: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 27 18:09:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-27 18:09:59 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:34404: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 27 18:09:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 27 18:10:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Jan 27 18:10:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 27 18:11:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-27 18:10:27 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:53176: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-01-27 18:10:36 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:43974: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.217
description:
[2025-01-27 18:10:42 +0100] info [webmaild] 84.54.73.217 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 27 18:10:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-27 18:10:12 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:45241: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-27 18:10:12 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:35759: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-27 18:10:15 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:39298: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 27 18:10:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-27 18:10:07 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:20810: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 27 18:10:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 27 18:10:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-27 18:10:25 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:35176: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.154
description:
Jan 27 18:10:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.154
description:
2025-01-27 18:10:49 dovecot_login authenticator failed for ([222.186.68.154]) [222.186.68.154]:54701: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
description:
2025-01-27 18:10:27 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:50360: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 27 18:10:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/images/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Jan 27 18:10:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-27 18:11:02 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:41778: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 18:11:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.117.88
description:
[2025-01-27 18:11:51 +0100] info [webmaild] 45.190.117.88 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 27 18:12:32 ait sshd[3127375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=gvu


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Jan 27 18:12:59 ait sshd[3127516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/data1/images/engine1/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Jan 27 18:12:59 ait sshd[3127516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Jan 27 18:12:32 ait sshd[3127375]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 18:12:40 ait sshd[3127444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 18:12:40 ait sshd[3127444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/images/js/data1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.106.29.210
description:
[2025-01-27 18:14:15 +0100] info [webmaild] 185.106.29.210 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 18:14:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 27 18:14:55 ait sshd[3128599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 18:14:55 ait sshd[3128599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/data1/images/data1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.178
description:
47.128.22.178 - - [27/Jan/2025:18:15:14 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8852799 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=92" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.178


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.192.167
description:
[2025-01-27 18:15:57 +0100] info [webmaild] 198.163.192.167 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:16:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.62.171
description:
Jan 27 18:17:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.62.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/data1/images/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/css/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
description:
Jan 27 18:17:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
description:
2025-01-27 18:17:12 dovecot_login authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:49664: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.22.238.40
description:
[2025-01-27 18:17:35 +0100] info [webmaild] 186.22.238.40 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.62.171
description:
2025-01-27 18:17:02 dovecot_login authenticator failed for ([103.147.62.171]) [103.147.62.171]:45812: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
description:
Jan 27 18:18:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
description:
2025-01-27 18:18:09 dovecot_login authenticator failed for (hn.kd.ny.adsl) [219.157.124.84]:45106: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/css/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.135.18.138
description:
Jan 27 18:18:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.135.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-27 18:18:26 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:51620: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
description:
Jan 27 18:18:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-01-27 18:18:11 dovecot_login authenticator failed for ([31.173.9.222]) [31.173.9.222]:57040: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 27 18:18:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.135.18.138
description:
2025-01-27 18:18:24 dovecot_login authenticator failed for ([61.135.18.138]) [61.135.18.138]:51510: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.85.91.91
description:
[2025-01-27 18:18:44 +0100] info [webmaild] 187.85.91.91 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 27 18:19:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/data1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:20:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-27 18:19:03 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:50866: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:20:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Jan 27 18:20:19 ait sshd[3131712]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 27 18:20:19 ait sshd[3131712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/images/data1/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/engine1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 18:21:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-27 18:22:23 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:56582: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.103.144
description:
[2025-01-27 18:22:34 +0100] info [webmaild] 45.231.103.144 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/css/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 27 18:22:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.148.195.75
description:
[2025-01-27 18:23:28 +0100] info [webmaild] 186.148.195.75 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 27 18:24:05 ait sshd[3133525]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 27 18:24:05 ait sshd[3133525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 18:24:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/css/images/data1/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/css/js/css/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 27 18:26:56 ait sshd[3135188]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 27 18:26:56 ait sshd[3135188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=gvu


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/engine1/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.91.92
description:
Jan 27 18:28:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.91.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.91.92
description:
2025-01-27 18:28:57 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.91.92]:44178: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/css/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 27 18:28:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-27 18:28:35 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:40973: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 18:29:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/css/images/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 18:30:12 ait sshd[3137153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/js/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.132.222.40
description:
[2025-01-27 18:30:37 +0100] info [webmaild] 188.132.222.40 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 18:30:12 ait sshd[3137153]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/data1/images/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-01-27 18:31:18 dovecot_login authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:45302: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.253.217.0
description:
[2025-01-27 18:31:49 +0100] info [webmaild] 188.253.217.0 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
description:
2025-01-27 18:31:06 dovecot_login authenticator failed for ([113.193.53.56]) [113.193.53.56]:34074: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:31:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/js/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/js/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 27 18:33:40 ait sshd[3138908]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 27 18:33:40 ait sshd[3138908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.162.51.61
description:
[2025-01-27 18:35:00 +0100] info [webmaild] 103.162.51.61 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
description:
2025-01-27 18:35:29 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:35390: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.211
description:
2025-01-27 18:35:30 dovecot_login authenticator failed for ([195.178.110.211]) [195.178.110.211]:52223: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/engine1/images/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.22.248
description:
[2025-01-27 18:35:23 +0100] info [webmaild] 45.224.22.248 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
description:
Jan 27 18:35:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.69.64
description:
[2025-01-27 18:35:10 +0100] info [webmaild] 170.245.69.64 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-01-27 18:35:11 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:50107: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.209.115.194
description:
[2025-01-27 18:35:59 +0100] info [webmaild] 181.209.115.194 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/css/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 27 18:37:04 ait sshd[3140792]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 27 18:37:04 ait sshd[3140792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.161.213
description:
[2025-01-27 18:37:05 +0100] info [webmaild] 131.255.161.213 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/css/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/engine1/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.24.102.252
description:
[2025-01-27 18:39:34 +0100] info [webmaild] 200.24.102.252 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.26
description:
Jan 27 18:39:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-27 18:39:30 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:58167: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.26
description:
2025-01-27 18:39:51 dovecot_login authenticator failed for ([104.241.233.26]) [104.241.233.26]:59279: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
description:
2025-01-27 18:40:41 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:20256: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-27 18:40:38 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:55723: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-01-27 18:40:20 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:54822: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
description:
Jan 27 18:40:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-27 18:40:27 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:52932: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/data1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/data1/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.35.152
description:
[2025-01-27 18:41:56 +0100] info [webmaild] 186.233.35.152 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
description:
2025-01-27 18:42:13 dovecot_login authenticator failed for (user-static-94-254-244-211.mobile.play-internet.pl) [94.254.244.211]:42510: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 27 18:42:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Jan 27 18:42:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 18:42:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 27 18:42:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.254.244.211
description:
Jan 27 18:42:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.254.244.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 27 18:42:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 27 18:42:20 ait sshd[3143710]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 27 18:42:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-27 18:42:55 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:36414: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/js/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-01-27 18:42:03 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:40551: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-27 18:42:20 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:41214: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 27 18:42:20 ait sshd[3143710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 18:42:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 18:42:31 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:39294: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-27 18:42:38 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:16937: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 221.156.137.103
description:
Jan 27 18:42:20 ait sshd[3143710]: Invalid user universitypublishing from 221.156.137.103 port 44312


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-27 18:42:19 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:44994: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-01-27 18:42:25 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:37828: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-01-27 18:42:55 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:52338: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.103.25.50
description:
[2025-01-27 18:42:05 +0100] info [webmaild] 185.103.25.50 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-27 18:42:29 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:45656: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-01-27 18:42:54 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:48468: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-01-27 18:42:54 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:20112: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Jan 27 18:42:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Jan 27 18:42:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Jan 27 18:42:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 27 18:42:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 27 18:42:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.232.230.220
description:
[2025-01-27 18:43:54 +0100] info [webmaild] 181.232.230.220 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.74
description:
2025-01-27 18:43:11 dovecot_login authenticator failed for ([104.241.238.74]) [104.241.238.74]:57723: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.195.38
description:
Jan 27 18:43:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.195.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 18:43:33 ait sshd[3144470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 27 18:43:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 18:43:33 ait sshd[3144470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.55
description:
Jan 27 18:43:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-27 18:43:52 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:55566: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-27 18:43:08 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:57612: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.74
description:
Jan 27 18:43:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 18:43:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.245.37
description:
2025-01-27 18:43:11 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:42484: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.55
description:
2025-01-27 18:43:37 dovecot_login authenticator failed for ([104.241.236.55]) [104.241.236.55]:46830: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 27 18:43:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 27 18:43:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-27 18:43:16 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:11579: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 18:43:41 ait sshd[3144616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 27 18:43:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.245.37
description:
Jan 27 18:43:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.245.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-27 18:43:54 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:60783: 535 Incorrect authentication data (set_id=prueba)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.195.38
description:
2025-01-27 18:43:15 dovecot_login authenticator failed for ([190.121.195.38]) [190.121.195.38]:59847: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 18:43:41 ait sshd[3144616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 18:44:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-27 18:44:28 dovecot_login authenticator failed for ([112.123.199.111]) [112.132.14.159]:38996: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-27 18:44:45 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:60190: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 27 18:44:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-27 18:44:44 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:60582: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.247.90
description:
2025-01-27 18:44:45 dovecot_login authenticator failed for ([36.154.247.90]) [36.154.247.90]:43411: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/engine1/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 27 18:44:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-27 18:44:19 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:63471: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 27 18:44:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-27 18:44:28 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:49474: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.220
description:
Jan 27 18:44:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 27 18:44:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-27 18:44:40 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:57788: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
description:
Jan 27 18:44:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 27 18:44:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 27 18:44:28 ait sshd[3145079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Jan 27 18:44:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.129.114
description:
2025-01-27 18:45:00 dovecot_login authenticator failed for ([14.48.129.114]) [14.48.129.114]:53276: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
description:
2025-01-27 18:44:42 dovecot_login authenticator failed for (hn.kd.ny.adsl) [219.157.124.84]:54122: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.247.90
description:
Jan 27 18:44:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 27 18:44:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 27 18:44:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.220
description:
2025-01-27 18:44:22 dovecot_login authenticator failed for ([104.241.238.220]) [104.241.238.220]:35275: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 27 18:44:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 27 18:44:28 ait sshd[3145079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-01-27 18:44:35 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:43162: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-01-27 18:44:43 dovecot_login authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:20247: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 27 18:44:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 27 18:44:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-27 18:44:29 dovecot_login authenticator failed for ([14.37.125.43]) [14.37.125.43]:51469: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-27 18:44:09 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:59956: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-27 18:44:25 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:20782: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-27 18:44:27 dovecot_login authenticator failed for ([93.182.160.222]) [93.182.160.222]:42158: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Jan 27 18:44:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
description:
Jan 27 18:44:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 27 18:45:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.245.37
description:
Jan 27 18:45:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.245.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 18:45:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 27 18:45:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 18:45:23 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:34832: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 27 18:45:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 18:45:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-27 18:45:41 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:50296: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-01-27 18:45:23 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:52710: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-27 18:45:25 dovecot_login authenticator failed for ([60.223.252.57]) [60.223.252.57]:49168: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.136.241
description:
[2025-01-27 18:45:30 +0100] info [webmaild] 45.168.136.241 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.106.154.237
description:
2025-01-27 18:45:34 dovecot_login authenticator failed for ([149.106.154.237]) [149.106.154.237]:54652: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/engine1/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.245.37
description:
2025-01-27 18:45:07 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:45415: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.30.3
description:
2025-01-27 18:45:38 dovecot_login authenticator failed for ([118.43.30.3]) [118.43.30.3]:55269: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 27 18:45:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-27 18:45:27 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:38607: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.106.154.237
description:
Jan 27 18:45:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.106.154.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.43.30.3
description:
Jan 27 18:45:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.43.30.3 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.160.25.51
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-46.217.160.25.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-27 18:46:50 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:39138: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 18:46:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 18:46:54 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:34848: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/images/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-01-27 18:46:36 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:15718: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 27 18:46:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-27 18:46:47 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:47304: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.37.144
description:
Jan 27 18:46:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.37.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.37.144
description:
2025-01-27 18:46:33 dovecot_login authenticator failed for ([220.180.37.144]) [220.180.37.144]:51884: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
description:
Jan 27 18:46:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
description:
Jan 27 18:46:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Jan 27 18:46:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
description:
2025-01-27 18:46:33 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:23554: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 27 18:46:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
description:
2025-01-27 18:46:48 dovecot_login authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:7407: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 18:47:03 ait sshd[3146534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.234.185
description:
[2025-01-27 18:47:09 +0100] info [webmaild] 168.0.234.185 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 18:47:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
description:
Jan 27 18:47:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/engine1/engine1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 18:47:03 ait sshd[3146534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-01-27 18:47:08 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:42824: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.133.246.44
description:
[2025-01-27 18:48:37 +0100] info [webmaild] 103.133.246.44 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 27 18:48:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.246.91
description:
2025-01-27 18:49:01 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:49630: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:48:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 27 18:49:06 ait sshd[3147707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 27 18:49:06 ait sshd[3147707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 27 18:49:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-27 18:49:14 dovecot_login authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:59178: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/data1/images/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 65.20.135.34
description:
[2025-01-27 18:50:35 +0100] info [webmaild] 65.20.135.34 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 18:50:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/css/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 18:50:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.196.60.148
description:
Jan 27 18:50:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.196.60.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.196.60.148
description:
2025-01-27 18:50:32 dovecot_plain authenticator failed for (forabal) [156.196.60.148]:34360: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/data1/images/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 18:51:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/data1/images/data1/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/css/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.91.165
description:
Jan 27 18:54:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.91.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-27 18:54:50 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:37008: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Jan 27 18:54:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-01-27 18:54:53 dovecot_login authenticator failed for ([5.31.13.120]) [5.31.13.120]:37298: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.91.165
description:
2025-01-27 18:54:36 dovecot_login authenticator failed for ([65.76.91.165]) [65.76.91.165]:43186: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.25.73
description:
Jan 27 18:54:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.25.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.25.73
description:
2025-01-27 18:54:44 dovecot_login authenticator failed for ([31.173.25.73]) [31.173.25.73]:52893: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 27 18:54:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:54:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 27 18:55:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-27 18:55:54 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:33784: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.11.10
description:
2025-01-27 18:55:40 dovecot_login authenticator failed for ([112.78.11.10]) [112.78.11.10]:59296: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/data1/images/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.11.10
description:
Jan 27 18:55:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 18:55:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/css/js/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 27 18:56:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-27 18:56:55 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:38540: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.150.88.194
description:
Jan 27 18:56:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.150.88.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-27 18:56:51 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:52602: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 27 18:56:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
description:
Jan 27 18:57:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 18:57:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.149.83.62
description:
Jan 27 18:57:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.149.83.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-27 18:57:38 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:54430: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.86.4
description:
Jan 27 18:57:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.86.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Jan 27 18:57:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 27 18:57:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
description:
2025-01-27 18:57:46 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:47972: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/css/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-01-27 18:57:08 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:48607: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
description:
2025-01-27 18:57:33 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:48919: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-27 18:57:35 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:44600: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
description:
2025-01-27 18:57:50 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:51517: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:57:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 27 18:57:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-27 18:57:46 dovecot_login authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:39023: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Jan 27 18:57:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-01-27 18:57:31 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:52226: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 27 18:57:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 27 18:57:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
description:
2025-01-27 18:57:05 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:45122: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
description:
Jan 27 18:57:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.117.54.11
description:
2025-01-27 18:57:45 dovecot_login authenticator failed for ([180.117.54.11]) [180.117.54.11]:40346: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-27 18:57:52 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:59314: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 27 18:58:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-27 18:58:43 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:60680: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 27 18:58:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/css/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 18:58:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.249.230.1
description:
[2025-01-27 18:58:24 +0100] info [webmaild] 89.249.230.1 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-27 18:58:37 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:21070: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-27 18:58:41 dovecot_login authenticator failed for (170.250.152.88.hwccustomers.com) [170.250.152.88]:49108: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 18:58:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 27 18:58:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-27 18:58:02 dovecot_login authenticator failed for ([59.4.255.205]) [59.4.255.205]:43592: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.128.225
description:
Jan 27 18:58:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.128.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.128.225
description:
2025-01-27 18:58:25 dovecot_login authenticator failed for (ip-178-46-128-225.dsl.surnet.ru) [178.46.128.225]:46933: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-27 18:58:03 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.138]:33792: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 18:58:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 18:58:29 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:53204: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 27 18:58:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 27 18:58:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 27 18:58:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-27 18:58:48 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38643: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.174.211.84
description:
[2025-01-27 18:59:30 +0100] info [webmaild] 185.174.211.84 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-27 18:59:56 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:60105: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 27 18:59:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.88.104
description:
Jan 27 18:59:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.88.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.88.104
description:
2025-01-27 18:59:41 dovecot_login authenticator failed for ([1.235.88.104]) [1.235.88.104]:52975: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 27 18:59:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-27 18:59:47 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:43026: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 27 18:59:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-27 18:59:56 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:41404: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 27 19:00:37 ait sshd[3153931]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Jan 27 19:00:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.117.92.118
description:
2025-01-27 19:00:08 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:50566: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 27 19:00:37 ait sshd[3153931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 27 19:00:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.117.92.118
description:
Jan 27 19:00:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.117.92.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-01-27 19:00:09 dovecot_login authenticator failed for (m121-202-152-7.smartone.com) [121.202.152.7]:2989: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/images/js/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-27 19:00:56 dovecot_login authenticator failed for ([106.86.209.86]) [106.86.209.86]:5940: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 27 19:01:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/css/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-27 19:01:17 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:53963: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 19:01:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-27 19:01:58 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:37998: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 27 19:01:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 27 19:01:25 ait sshd[3154486]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 19:01:25 ait sshd[3154486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.123.47
description:
2025-01-27 19:01:33 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [27.72.123.47]:45968: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-01-27 19:01:38 dovecot_login authenticator failed for ([185.168.173.87]) [185.168.173.87]:39128: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-27 19:01:12 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:4581: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.249.94.203
description:
[2025-01-27 19:01:16 +0100] info [webmaild] 41.249.94.203 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.123.47
description:
Jan 27 19:01:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.123.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Jan 27 19:01:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 27 19:01:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.210.59.156
description:
[2025-01-27 19:02:19 +0100] info [webmaild] 179.210.59.156 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 27 19:02:22 ait sshd[3154954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.111
description:
Jan 27 19:02:22 ait sshd[3154954]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 27 19:02:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 27 19:02:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-01-27 19:02:12 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:51116: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-27 19:02:19 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (shocriana) [91.56.31.108]:59946: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 27 19:02:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-27 19:02:27 dovecot_login authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:40778: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/css/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 19:03:31 ait sshd[3155738]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 27 19:03:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.63.181.67
description:
[2025-01-27 19:03:06 +0100] info [webmaild] 41.63.181.67 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 27 19:03:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-27 19:03:52 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:53647: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 19:03:18 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:50050: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 19:03:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.46.63.66
description:
[2025-01-27 19:03:15 +0100] info [webmaild] 41.46.63.66 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 19:03:31 ait sshd[3155738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-27 19:03:31 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:53351: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.144.175
description:
[2025-01-27 19:04:58 +0100] info [webmaild] 45.70.144.175 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
description:
Jan 27 19:04:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
description:
2025-01-27 19:04:06 dovecot_login authenticator failed for ([103.190.91.98]) [103.190.91.98]:43775: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/engine1/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/js/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-27 19:05:37 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:50420: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.24.68
description:
Jan 27 19:05:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.24.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.24.68
description:
2025-01-27 19:05:49 dovecot_login authenticator failed for syn-173-095-024-068.biz.spectrum.com [173.95.24.68]:3080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
description:
Jan 27 19:05:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 27 19:05:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/js/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.111
description:
Jan 27 19:06:31 ait sshd[3157514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-27 19:06:58 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:40380: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 27 19:06:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-27 19:06:02 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:20270: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.111
description:
Jan 27 19:06:31 ait sshd[3157514]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.161.123
description:
2025-01-27 19:06:55 dovecot_login authenticator failed for ([93.182.161.123]) [93.182.161.123]:43626: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 27 19:06:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 27 19:06:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 27 19:06:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.188.18.25
description:
Jan 27 19:06:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.188.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
description:
2025-01-27 19:06:37 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:61787: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-27 19:06:46 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:59646: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.161.123
description:
Jan 27 19:06:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.161.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-27 19:06:15 dovecot_login authenticator failed for (nsg-static-170.125.76.182-airtel.com) [182.76.87.90]:51708: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.248.26.21
description:
Jan 27 19:06:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.248.26.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.248.26.21
description:
2025-01-27 19:06:25 dovecot_login authenticator failed for syn-067-248-026-021.res.spectrum.com [67.248.26.21]:56358: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 27 19:07:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/engine1/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.36.195.209
description:
[2025-01-27 19:07:29 +0100] info [webmaild] 92.36.195.209 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-27 19:07:08 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:14687: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 19:07:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/css/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Jan 27 19:08:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-27 19:08:41 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:61070: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 27 19:08:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-27 19:08:52 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:46040: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-27 19:08:29 dovecot_login authenticator failed for ([116.113.254.26]) [116.113.254.26]:54988: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 27 19:08:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-27 19:08:49 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:41868: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 27 19:08:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-27 19:09:26 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:47818: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Jan 27 19:09:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
description:
Jan 27 19:09:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-01-27 19:09:36 dovecot_login authenticator failed for ([60.167.19.30]) [60.167.19.30]:35659: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.190.178.49
description:
[2025-01-27 19:09:48 +0100] info [webmaild] 78.190.178.49 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/images/css/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 27 19:09:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-27 19:09:22 dovecot_login authenticator failed for ([50.99.36.130]) [50.99.36.130]:35204: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 27 19:09:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.85.183
description:
Jan 27 19:09:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.183.85.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.85.183
description:
2025-01-27 19:09:56 dovecot_login authenticator failed for ([68.183.85.183]) [68.183.85.183]:59654: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 19:09:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 72.252.32.19
description:
[2025-01-27 19:09:57 +0100] info [webmaild] 72.252.32.19 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 27 19:09:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.247.249.10
description:
Jan 27 19:09:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.247.249.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
description:
2025-01-27 19:09:37 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 19:09:44 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:56199: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-27 19:09:52 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:37864: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.247.249.10
description:
2025-01-27 19:09:40 dovecot_login authenticator failed for ([61.247.249.10]) [61.247.249.10]:37316: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 19:10:27 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:15179: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-01-27 19:10:39 dovecot_login authenticator failed for (host-115-208-static-98-201.uninet-ide.com.mx) [201.98.208.115]:38375: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 27 19:10:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.148.10
description:
Jan 27 19:11:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.148.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 19:10:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-27 19:10:44 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:49632: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/css/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 27 19:10:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 19:10:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 19:10:53 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:35148: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-27 19:10:59 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:33772: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Jan 27 19:10:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
description:
2025-01-27 19:11:12 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:60740: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 19:11:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.236.251.61
description:
[2025-01-27 19:11:58 +0100] info [webmaild] 41.236.251.61 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.186
description:
Jan 27 19:11:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.186
description:
2025-01-27 19:11:25 dovecot_login authenticator failed for ([111.61.177.186]) [111.61.177.186]:41874: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/data1/images/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 27 19:13:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-27 19:13:09 dovecot_login authenticator failed for ([222.160.227.134]) [222.160.227.134]:36752: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-01-27 19:12:23 dovecot_login authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:52600: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Jan 27 19:12:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-01-27 19:12:41 dovecot_login authenticator failed for ([39.152.114.206]) [39.152.114.206]:33229: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-27 19:13:08 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:52996: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.171.159
description:
2025-01-27 19:13:08 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:48472: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
description:
Jan 27 19:12:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
description:
2025-01-27 19:12:54 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:37088: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 27 19:13:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.171.159
description:
Jan 27 19:13:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.171.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.243.187
description:
Jan 27 19:13:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.243.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Jan 27 19:12:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.210
description:
Jan 27 19:12:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.210
description:
2025-01-27 19:12:53 dovecot_login authenticator failed for ([104.241.237.210]) [104.241.237.210]:54157: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 27 19:12:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-27 19:12:56 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:48696: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-01-27 19:13:12 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:48919: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-01-27 19:13:28 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:53174: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.189.10
description:
[2025-01-27 19:13:35 +0100] info [webmaild] 45.162.189.10 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
description:
Jan 27 19:13:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-27 19:13:40 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:27010: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
description:
Jan 27 19:14:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
description:
2025-01-27 19:14:09 dovecot_login authenticator failed for ([111.61.177.3]) [111.61.177.3]:52226: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 19:13:25 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:56884: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 27 19:13:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.118.146.23
description:
[2025-01-27 19:13:55 +0100] info [webmaild] 196.118.146.23 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 19:13:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
description:
2025-01-27 19:13:42 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:63650: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 27 19:13:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-27 19:15:16 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:3979: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 27 19:14:44 ait sshd[3161851]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-01-27 19:14:59 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:33370: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 27 19:15:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 27 19:15:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/css/images/data1/engine1/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 27 19:14:44 ait sshd[3161851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 27 19:14:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-27 19:15:13 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:33992: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-27 19:15:27 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:58181: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.59.80.67
description:
[2025-01-27 19:15:42 +0100] info [webmaild] 176.59.80.67 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.246.91
description:
2025-01-27 19:15:41 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:38432: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
description:
Jan 27 19:15:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
description:
2025-01-27 19:15:46 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:50132: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 19:16:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 27 19:15:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/css/images/data1/engine1/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 27 19:15:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.118.157
description:
Jan 27 19:16:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.118.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.118.157
description:
2025-01-27 19:16:08 dovecot_plain authenticator failed for ([118.70.118.157]) [118.70.118.157]:40650: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-01-27 19:16:19 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:37106: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.215
description:
2025-01-27 19:16:50 dovecot_login authenticator failed for ([195.178.110.215]) [195.178.110.215]:58178: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Jan 27 19:16:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/css/images/data1/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 27 19:16:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-27 19:16:34 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:56028: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 27 19:16:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.215
description:
Jan 27 19:16:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-27 19:16:48 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:36913: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 27 19:17:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.127.40.19
description:
Jan 27 19:17:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.127.40.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 27 19:17:43 ait sshd[3163402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-27 19:17:47 dovecot_login authenticator failed for ([120.71.199.46]) [120.71.199.46]:51245: 535 Incorrect authentication data (set_id=valeria553)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/css/js/css/engine1/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.250.233
description:
2025-01-27 19:17:25 dovecot_login authenticator failed for p94233-obmd01.tokyo.ocn.ne.jp [124.101.250.233]:56780: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.127.40.19
description:
2025-01-27 19:17:31 dovecot_login authenticator failed for (115.127.40.33.bracnet.net) [115.127.40.19]:63702: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-01-27 19:17:34 dovecot_login authenticator failed for ([41.159.145.190]) [41.159.145.190]:44170: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 19:17:36 ait sshd[3163377]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 19:17:36 ait sshd[3163377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 27 19:17:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-27 19:17:17 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:39838: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Jan 27 19:17:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 27 19:17:43 ait sshd[3163402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 27 19:18:44 ait sshd[3163879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 27 19:18:44 ait sshd[3163879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/css/js/css/engine1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.182.8.100
description:
[2025-01-27 19:18:40 +0100] info [webmaild] 2.182.8.100 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/engine1/data1/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 27 19:19:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.202.15.69
description:
Jan 27 19:20:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.202.15.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-27 19:19:19 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:33115: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
description:
Jan 27 19:19:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-01-27 19:19:33 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:46294: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
description:
2025-01-27 19:20:11 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:33959: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 27 19:20:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-27 19:20:21 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:48752: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
description:
Jan 27 19:20:29 ait sshd[3165129]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/engine1/data1/images/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 27 19:20:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.251.57.55
description:
Jan 27 19:20:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.251.57.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.57.55
description:
2025-01-27 19:20:22 dovecot_login authenticator failed for (55.57.251.198.in-addr.arpa) [198.251.57.55]:51287: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.212
description:
Jan 27 19:20:29 ait sshd[3165129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-27 19:20:37 dovecot_login authenticator failed for ([183.105.138.168]) [211.35.237.38]:38695: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 27 19:21:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-27 19:21:09 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:58678: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-01-27 19:22:15 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:50598: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Jan 27 19:21:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/engine1/data1/images/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.204.22
description:
Jan 27 19:22:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.204.22
description:
2025-01-27 19:22:05 dovecot_plain authenticator failed for ([196.46.204.22]) [196.46.204.22]:60386: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Jan 27 19:22:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 19:21:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-01-27 19:21:20 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:46389: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 19:23:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 19:23:09 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:34037: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/engine1/data1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/js/css/data1/images/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-27 19:23:24 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:50706: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Jan 27 19:23:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
description:
2025-01-27 19:23:36 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:36380: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 19:23:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
description:
Jan 27 19:23:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 19:23:22 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:44808: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/engine1/js/css/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Jan 27 19:26:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/engine1/js/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.100.139.239
description:
[2025-01-27 19:25:54 +0100] info [webmaild] 131.100.139.239 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 27 19:26:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-27 19:26:05 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:57660: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/engine1/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-01-27 19:26:19 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:38100: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.188.225.14
description:
[2025-01-27 19:26:57 +0100] info [webmaild] 38.188.225.14 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.210.176
description:
Jan 27 19:27:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.210.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.210.176
description:
2025-01-27 19:27:17 dovecot_login authenticator failed for ([183.107.210.176]) [183.107.210.176]:58668: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
description:
2025-01-27 19:27:29 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:55818: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-27 19:27:34 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:35741: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.9.7.174
description:
Jan 27 19:27:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.9.7.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-01-27 19:27:58 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:47180: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.9.7.174
description:
2025-01-27 19:28:00 dovecot_plain authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:51114: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Jan 27 19:28:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-27 19:28:08 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:43913: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 27 19:27:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 27 19:27:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.247.195
description:
2025-01-27 19:27:49 dovecot_plain authenticator failed for ([46.138.247.195]) [46.138.247.195]:54464: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.120.254.4
description:
[2025-01-27 19:27:51 +0100] info [webmaild] 190.120.254.4 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 27 19:28:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/engine1/data1/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.247.195
description:
Jan 27 19:27:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.247.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-01-27 19:28:12 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:37793: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
description:
Jan 27 19:27:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-27 19:27:40 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:51885: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Jan 27 19:27:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.218
description:
Jan 27 19:28:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-01-27 19:28:26 dovecot_login authenticator failed for ([120.194.7.10]) [120.194.7.10]:53288: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/engine1/css/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.218
description:
2025-01-27 19:28:16 dovecot_login authenticator failed for ([195.178.110.218]) [195.178.110.218]:53341: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.7.10
description:
Jan 27 19:28:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.7.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-27 19:29:33 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:42194: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.193.7
description:
Jan 27 19:29:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.193.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.193.7
description:
2025-01-27 19:29:47 dovecot_login authenticator failed for ([120.194.193.7]) [120.194.193.7]:50297: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 27 19:30:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Jan 27 19:30:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/css/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Jan 27 19:29:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 27 19:29:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.253.18.251
description:
Jan 27 19:29:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.253.18.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-27 19:30:09 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:45809: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 164.68.105.226
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-30.164.68.105.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-01-27 19:29:32 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:51002: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.119.237
description:
[2025-01-27 19:30:06 +0100] info [webmaild] 45.177.119.237 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-27 19:29:56 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:50686: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-01-27 19:30:14 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:48167: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.253.18.251
description:
2025-01-27 19:29:43 dovecot_plain authenticator failed for ([120.253.18.251]) [120.253.18.251]:38910: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 27 19:29:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.203
description:
Jan 27 19:30:59 ait sshd[3170885]: error: maximum authentication attempts exceeded for root from 218.92.0.203 port 30740 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.0.59
description:
[2025-01-27 19:31:11 +0100] info [webmaild] 45.233.0.59 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/data1/data1/js/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-27 19:30:27 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:55668: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
description:
Jan 27 19:30:36 ait sshd[3170885]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.203
description:
Jan 27 19:30:36 ait sshd[3170885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
description:
2025-01-27 19:30:51 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:58111: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 27 19:30:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.157.136.239
description:
Jan 27 19:31:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.157.136.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 27 19:31:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-27 19:31:12 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:34908: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 27 19:30:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/data1/js/data1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-27 19:31:51 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:49046: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 27 19:32:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 27 19:32:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-27 19:32:04 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:53962: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 150.107.107.6
description:
[2025-01-27 19:31:31 +0100] info [webmaild] 150.107.107.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 27 19:31:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-27 19:32:06 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:42740: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.101.246
description:
[2025-01-27 19:33:09 +0100] info [webmaild] 45.70.101.246 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.163.16.40
description:
Jan 27 19:33:11 ait sshd[3172269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.163.16.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.163.16.40
description:
[2025-01-27 19:33:11 +0100] info [whostmgrd] 85.163.16.40 - Arminas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/images/images/data1/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.74.36
description:
Jan 27 19:34:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.74.36
description:
2025-01-27 19:34:15 dovecot_login authenticator failed for ([164.92.74.36]) [164.92.74.36]:45616: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.166
description:
Jan 27 19:33:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.218.28.118
description:
Jan 27 19:33:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.218.28.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-27 19:33:50 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:47082: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.20
description:
Jan 27 19:34:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 27 19:33:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.202
description:
2025-01-27 19:33:51 dovecot_plain authenticator failed for ([103.146.233.202]) [103.146.233.202]:41303: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 27 19:34:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.20
description:
2025-01-27 19:34:02 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:39936: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/images/js/images/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.166
description:
2025-01-27 19:33:43 dovecot_plain authenticator failed for 83-233-71-166.cust.bredband2.com [83.233.71.166]:37310: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.202
description:
Jan 27 19:33:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
description:
Jan 27 19:34:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.218.28.118
description:
2025-01-27 19:33:51 dovecot_login authenticator failed for (cpe-c83a353b2048.cpe.cableonda.net) [190.218.28.118]:37898: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
description:
2025-01-27 19:34:04 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:52627: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-27 19:34:25 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:39320: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Jan 27 19:34:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-27 19:34:40 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:47374: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-01-27 19:34:30 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:36534: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.42.100
description:
Jan 27 19:34:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.42.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Jan 27 19:35:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-27 19:34:16 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:19082: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/js/js/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 27 19:34:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.135.18.138
description:
2025-01-27 19:34:23 dovecot_login authenticator failed for ([61.135.18.138]) [61.135.18.138]:49160: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.135.18.138
description:
Jan 27 19:34:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.135.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 27 19:34:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-27 19:34:40 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:34224: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Jan 27 19:35:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 27 19:36:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Jan 27 19:36:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 27 19:35:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-27 19:35:36 dovecot_plain authenticator failed for ([37.57.69.227]) [37.57.69.227]:52533: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 27 19:35:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-27 19:36:01 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:48343: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/js/js/data1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 27 19:36:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-27 19:36:07 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:55002: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Jan 27 19:36:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-01-27 19:35:28 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:14237: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 19:35:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.189.71.91
description:
[2025-01-27 19:36:00 +0100] info [webmaild] 45.189.71.91 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-27 19:36:13 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:63417: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-01-27 19:36:13 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:47642: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-01-27 19:36:14 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:58924: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/data1/data1/css/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.40.228.65
description:
Jan 27 19:36:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.40.228.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.228.65
description:
2025-01-27 19:36:30 dovecot_plain authenticator failed for c-98-40-228-65.hsd1.tx.comcast.net [98.40.228.65]:63551: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.166.78
description:
Jan 27 19:36:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.166.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
description:
2025-01-27 19:36:42 dovecot_plain authenticator failed for ([223.197.166.78]) [223.197.166.78]:51968: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-27 19:37:49 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:42916: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 19:37:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Jan 27 19:37:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 27 19:37:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.237.81
description:
[2025-01-27 19:37:57 +0100] info [webmaild] 138.186.237.81 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.189.17.178
description:
[2025-01-27 19:38:13 +0100] info [webmaild] 187.189.17.178 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/css/data1/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-01-27 19:37:38 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:57356: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/css/css/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 19:38:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 19:40:00 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:38488: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.36.23
description:
[2025-01-27 19:39:32 +0100] info [webmaild] 188.163.36.23 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Jan 27 19:39:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-01-27 19:39:47 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:49754: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 19:39:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/engine1/data1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/data1/js/data1/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 27 19:40:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Jan 27 19:40:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.145.251
description:
Jan 27 19:41:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.145.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-27 19:41:04 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (propred) [109.67.154.24]:54106: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.79.34
description:
2025-01-27 19:41:05 dovecot_plain authenticator failed for ([59.10.79.34]) [59.10.79.34]:53164: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Jan 27 19:41:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-27 19:40:34 dovecot_login authenticator failed for ([2.57.219.14]) [2.57.219.2]:59428: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
description:
2025-01-27 19:40:47 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:37669: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 27 19:41:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-01-27 19:41:12 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:52312: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.154.229
description:
[2025-01-27 19:40:16 +0100] info [webmaild] 41.56.154.229 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Jan 27 19:40:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.145.251
description:
2025-01-27 19:41:02 dovecot_plain authenticator failed for ([183.245.145.251]) [183.245.145.251]:51340: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-01-27 19:40:54 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:41208: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.10.79.34
description:
Jan 27 19:41:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.10.79.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 19:41:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 19:41:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/js/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.113.252.230
description:
[2025-01-27 19:41:43 +0100] info [webmaild] 188.113.252.230 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 27 19:41:54 ait sshd[3177514]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 27 19:41:54 ait sshd[3177514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 19:42:55 ait sshd[3178060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 27 19:42:32 ait sshd[3177795]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 27 19:42:32 ait sshd[3177795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 19:42:55 ait sshd[3178060]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/engine1/js/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Jan 27 19:43:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.151.236.178
description:
Jan 27 19:44:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.151.236.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.253.218.126
description:
[2025-01-27 19:44:12 +0100] info [webmaild] 188.253.218.126 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 27 19:43:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-27 19:43:42 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:43784: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-27 19:43:50 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:49710: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-27 19:43:26 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [103.109.44.163]:47290: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/data1/data1/css/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-01-27 19:43:31 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:11087: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 27 19:43:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 27 19:43:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.151.236.178
description:
2025-01-27 19:44:15 dovecot_plain authenticator failed for ([91.151.236.178]) [91.151.236.178]:60736: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
description:
2025-01-27 19:44:25 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:35753: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 27 19:45:16 ait sshd[3179470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
description:
Jan 27 19:44:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Jan 27 19:44:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-27 19:45:04 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:49574: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 27 19:45:16 ait sshd[3179470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/css/css/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-01-27 19:44:54 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:45385: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.51.226.207
description:
Jan 27 19:45:18 ait sshd[3179470]: Failed password for invalid user aitedu from 20.51.226.207 port 52906 ssh2


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/data1/js/css/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.174.226
description:
Jan 27 19:45:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.174.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 27 19:46:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.174.226
description:
2025-01-27 19:45:35 dovecot_plain authenticator failed for ([58.216.174.226]) [58.216.174.226]:28206: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.196
description:
Jan 27 19:46:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 27 19:46:28 ait sshd[3180063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.45.10
description:
2025-01-27 19:46:37 dovecot_plain authenticator failed for ([125.32.45.10]) [125.32.45.10]:46426: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.180.244.157
description:
[2025-01-27 19:46:47 +0100] info [webmaild] 200.180.244.157 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-27 19:46:18 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:45248: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-27 19:46:51 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:35998: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-01-27 19:47:01 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:3454: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 27 19:46:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/data1/images/js/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.196
description:
2025-01-27 19:46:21 dovecot_plain authenticator failed for ([76.77.25.196]) [76.77.25.196]:57644: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-27 19:46:29 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:39068: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.45.10
description:
Jan 27 19:46:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 27 19:46:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Jan 27 19:46:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/engine1/data1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 27 19:47:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-01-27 19:47:35 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:31002: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-27 19:49:03 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:40812: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 27 19:49:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-27 19:49:10 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:39094: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/data1/data1/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-01-27 19:48:19 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:50370: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.52
description:
2025-01-27 19:49:13 dovecot_login authenticator failed for ([103.146.233.52]) [103.146.233.52]:51495: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
description:
Jan 27 19:48:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.62.3
description:
Jan 27 19:49:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.62.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 27 19:49:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.92.253.164
description:
Jan 27 19:49:11 ait sshd[3181474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.92.253.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
description:
Jan 27 19:48:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
description:
2025-01-27 19:48:54 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:36134: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.62.3
description:
2025-01-27 19:49:02 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:50616: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
description:
Jan 27 19:48:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
description:
2025-01-27 19:48:56 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:58538: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.52
description:
Jan 27 19:49:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
description:
Jan 27 19:48:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
description:
2025-01-27 19:48:27 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:37606: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Jan 27 19:49:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-27 19:49:44 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:50228: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-27 19:50:04 dovecot_plain authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:38993: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.202.130.61
description:
Jan 27 19:50:05 ait sshd[3182095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.202.130.61


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.11.10
description:
Jan 27 19:49:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Jan 27 19:49:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-27 19:49:53 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:39414: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.202.130.61
description:
Jan 27 19:50:05 ait sshd[3182095]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.202.130.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-27 19:50:08 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:55310: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/js/images/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
description:
Jan 27 19:49:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 27 19:49:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.11.10
description:
2025-01-27 19:49:41 dovecot_login authenticator failed for ([112.78.11.10]) [112.78.11.10]:54520: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-01-27 19:49:44 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:55061: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 27 19:49:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 27 19:49:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-01-27 19:50:03 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:50636: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.218
description:
2025-01-27 19:50:14 dovecot_plain authenticator failed for ([103.58.67.218]) [103.58.67.218]:50620: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
description:
2025-01-27 19:49:33 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:40472: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
description:
Jan 27 19:49:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 19:49:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.67.218
description:
Jan 27 19:50:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.67.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-27 19:49:42 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:33683: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-27 19:49:54 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:38710: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Jan 27 19:49:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.212.174
description:
2025-01-27 19:49:58 dovecot_login authenticator failed for ([103.142.212.174]) [103.142.212.174]:46730: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-01-27 19:49:59 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:51388: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 27 19:50:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
description:
2025-01-27 19:49:42 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:43683: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 27 19:50:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-27 19:50:15 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:46608: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 27 19:49:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.212.174
description:
Jan 27 19:49:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.212.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Jan 27 19:50:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
description:
2025-01-27 19:49:21 dovecot_plain authenticator failed for ([191.217.137.126]) [191.217.137.126]:59387: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
description:
Jan 27 19:50:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 19:50:47 ait sshd[3182637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 27 19:51:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-27 19:51:01 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:57161: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-27 19:51:01 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:51524: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-01-27 19:50:51 dovecot_login authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:1230: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.196.131
description:
2025-01-27 19:50:38 dovecot_plain authenticator failed for ([120.82.196.131]) [120.82.196.131]:52602: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-27 19:51:16 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:20407: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.196.131
description:
Jan 27 19:50:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.196.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 27 19:50:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Jan 27 19:50:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 27 19:50:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.64.20
description:
Jan 27 19:51:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.64.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 27 19:51:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/data1/images/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
description:
2025-01-27 19:51:04 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:44634: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Jan 27 19:51:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-27 19:50:21 dovecot_plain authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:45963: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.64.20
description:
2025-01-27 19:51:11 dovecot_plain authenticator failed for ([94.207.64.20]) [94.207.64.20]:38706: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
description:
2025-01-27 19:50:29 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:35596: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Jan 27 19:50:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-01-27 19:50:58 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:38602: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 27 19:50:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-01-27 19:51:13 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:43036: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 27 19:51:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
description:
2025-01-27 19:51:50 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:46051: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 27 19:51:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.107.198
description:
Jan 27 19:52:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.107.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.216
description:
2025-01-27 19:51:23 dovecot_login authenticator failed for ([195.178.110.216]) [195.178.110.216]:53758: 535 Incorrect authentication data (set_id=scanner)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
description:
2025-01-27 19:51:29 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:44956: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
description:
Jan 27 19:51:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-27 19:52:01 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:40561: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.216
description:
Jan 27 19:51:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 27 19:52:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.199.20
description:
Jan 27 19:52:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.199.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
description:
2025-01-27 19:52:55 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:46073: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
description:
2025-01-27 19:53:03 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:37070: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/css/engine1/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.97
description:
2025-01-27 19:52:35 dovecot_login authenticator failed for ([193.32.162.97]) [193.32.162.97]:63451: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
description:
Jan 27 19:53:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.207.134
description:
Jan 27 19:52:19 ait sshd[3183467]: pam_imunify(sshd:auth): [IM360_RBL] The IP 15.235.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.237.8.37
description:
Jan 27 19:52:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.237.8.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.66
description:
2025-01-27 19:52:46 dovecot_login authenticator failed for ([193.32.162.66]) [193.32.162.66]:64872: 535 Incorrect authentication data (set_id=backup)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
description:
Jan 27 19:52:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.73
description:
2025-01-27 19:52:58 dovecot_login authenticator failed for ([193.32.162.73]) [193.32.162.73]:64211: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 15.235.207.134
description:
Jan 27 19:52:19 ait sshd[3183467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.207.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.237.8.37
description:
2025-01-27 19:52:28 dovecot_login authenticator failed for ([58.237.8.37]) [58.237.8.37]:42224: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.83
description:
2025-01-27 19:53:01 dovecot_login authenticator failed for ([193.32.162.83]) [193.32.162.83]:57686: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.81
description:
Jan 27 19:53:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.93.34.129
description:
[2025-01-27 19:52:23 +0100] info [webmaild] 91.93.34.129 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.49.216.35
description:
Jan 27 19:52:30 ait sshd[3183563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.49.216.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.73
description:
Jan 27 19:52:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.97
description:
Jan 27 19:52:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.66
description:
Jan 27 19:52:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.83
description:
Jan 27 19:52:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.81
description:
2025-01-27 19:53:11 dovecot_login authenticator failed for ([193.32.162.81]) [193.32.162.81]:52696: 535 Incorrect authentication data (set_id=fax)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-27 19:52:42 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:43842: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.199.20
description:
2025-01-27 19:52:45 dovecot_plain authenticator failed for ([157.122.199.20]) [157.122.199.20]:39556: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.107.198
description:
2025-01-27 19:52:17 dovecot_plain authenticator failed for ([187.92.178.105]) [187.8.107.198]:49439: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.42.214.20
description:
Jan 27 19:53:50 ait sshd[3184204]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.42.214.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.202.130.61
description:
Jan 27 19:54:04 ait sshd[3184448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.202.130.61


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Jan 27 19:53:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.54.49
description:
2025-01-27 19:54:07 dovecot_plain authenticator failed for ([58.115.54.49]) [58.115.54.49]:37437: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.92.253.164
description:
Jan 27 19:54:12 ait sshd[3184604]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.92.253.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-27 19:53:54 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:58138: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.8.150
description:
2025-01-27 19:54:08 dovecot_login authenticator failed for ([190.61.8.150]) [190.61.8.150]:60476: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/js/js/css/data1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 27 19:53:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.42.214.20
description:
Jan 27 19:53:50 ait sshd[3184204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.42.214.20


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.202.130.61
description:
Jan 27 19:54:04 ait sshd[3184448]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.202.130.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
description:
2025-01-27 19:53:55 dovecot_login authenticator failed for ([151.3.178.94]) [151.3.178.94]:40380: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.92.253.164
description:
Jan 27 19:54:12 ait sshd[3184604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.92.253.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 27 19:53:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.54.49
description:
Jan 27 19:54:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.54.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-01-27 19:53:40 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:35740: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.178.94
description:
Jan 27 19:53:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.178.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-27 19:53:26 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:46772: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-01-27 19:53:35 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:42341: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.245.249
description:
[2025-01-27 19:53:35 +0100] info [webmaild] 45.162.245.249 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 27 19:53:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.61.8.150
description:
Jan 27 19:54:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.61.8.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/data1/css/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 27 19:54:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 15.235.207.134
description:
Jan 27 19:54:51 ait sshd[3184789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.207.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-27 19:54:39 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:36584: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 19:54:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 27 19:55:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-27 19:55:17 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (sperness) [92.244.126.105]:55412: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-27 19:54:37 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:39401: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 27 19:54:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.207.134
description:
Jan 27 19:54:51 ait sshd[3184789]: pam_imunify(sshd:auth): [IM360_RBL] The IP 15.235.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 19:54:58 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:33829: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 19:54:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.202.130.61
description:
Jan 27 19:55:33 ait sshd[3185292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.202.130.61


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.10
description:
Jan 27 19:56:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.202.130.61
description:
Jan 27 19:55:33 ait sshd[3185292]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.202.130.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.92.253.164
description:
Jan 27 19:55:37 ait sshd[3185326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.92.253.164


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Jan 27 19:55:46 ait sshd[3185417]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-27 19:56:16 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:64685: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Jan 27 19:55:46 ait sshd[3185417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-27 19:56:00 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:53740: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.10
description:
2025-01-27 19:56:12 dovecot_login authenticator failed for ([104.241.238.10]) [104.241.238.10]:45084: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.92.253.164
description:
Jan 27 19:55:37 ait sshd[3185326]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.92.253.164 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.202.130.61
description:
Jan 27 19:55:36 ait sshd[3185292]: Failed password for invalid user debian from 190.202.130.61 port 39216 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 27 19:55:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.24.123
description:
[2025-01-27 19:55:58 +0100] info [webmaild] 187.73.24.123 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
description:
Jan 27 19:56:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-01-27 19:56:12 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:46181: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/css/data1/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.212.183.97
description:
2025-01-27 19:56:58 dovecot_plain authenticator failed for ([182.212.183.97]) [182.212.183.97]:59622: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-27 19:56:24 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:33746: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.15.178.174
description:
Jan 27 19:56:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.15.178.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.63.203.111
description:
2025-01-27 19:56:33 dovecot_login authenticator failed for lmontsouris-655-1-111-111.w90-63.abo.wanadoo.fr [90.63.203.111]:56264: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
description:
Jan 27 19:56:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.213.164.27
description:
2025-01-27 19:56:50 dovecot_plain authenticator failed for ([1.213.164.27]) [1.213.164.27]:41032: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-27 19:56:53 dovecot_plain authenticator failed for ([91.234.132.226]) [91.234.132.226]:53891: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.212.183.97
description:
Jan 27 19:56:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.212.183.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
description:
2025-01-27 19:57:05 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:32874: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/data1/data1/js/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 15.235.207.134
description:
Jan 27 19:56:22 ait sshd[3185812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.207.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.63.203.111
description:
Jan 27 19:56:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.63.203.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
description:
2025-01-27 19:56:47 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:50705: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-01-27 19:57:16 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:36325: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 27 19:56:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.178.174
description:
2025-01-27 19:56:30 dovecot_plain authenticator failed for ([60.15.178.174]) [60.15.178.174]:39104: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-01-27 19:57:04 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:44205: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
description:
Jan 27 19:57:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.207.134
description:
Jan 27 19:56:22 ait sshd[3185812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 15.235.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.213.164.27
description:
Jan 27 19:56:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.213.164.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 27 19:56:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Jan 27 19:57:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
description:
Jan 27 19:57:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 27 19:57:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 27 19:58:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-27 19:57:30 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:38368: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.182
description:
Jan 27 19:57:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.158.124.22
description:
[2025-01-27 19:57:39 +0100] info [webmaild] 146.158.124.22 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
description:
2025-01-27 19:57:42 dovecot_plain authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:36601: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-27 19:58:07 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:5482: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-27 19:58:16 +0100] info [whostmgrd] 217.160.25.51 - www.lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 27 19:57:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-27 19:57:45 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:52786: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.63.203.111
description:
Jan 27 19:57:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.63.203.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-27 19:58:02 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:50751: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 27 19:58:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/css/css/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.63.203.111
description:
2025-01-27 19:57:48 dovecot_login authenticator failed for lmontsouris-655-1-111-111.w90-63.abo.wanadoo.fr [90.63.203.111]:58084: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.160.25.51
description:
Jan 27 19:58:37 ait sshd[3186670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.160.25.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.212
description:
Jan 27 19:59:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-27 19:58:23 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:59423: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-01-27 19:58:23 dovecot_login authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:38317: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
description:
2025-01-27 19:58:33 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:41508: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.25.51
description:
Jan 27 19:58:37 ait sshd[3186670]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.160.25.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Jan 27 19:58:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.153.64
description:
[2025-01-27 19:58:57 +0100] info [webmaild] 170.254.153.64 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.160.25.51
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:www.lemsas.net||WPU:www.lemsas.net||RSV:6.65||T:APACHE||MV:19-58.217.160.25.51


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.42.214.20
description:
Jan 27 19:58:39 ait sshd[3186669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.42.214.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
description:
Jan 27 19:58:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.42.214.20
description:
Jan 27 19:58:39 ait sshd[3186669]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.42.214.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/engine1/engine1/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 19:59:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 27 19:58:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.154.199.12
description:
Jan 27 19:59:20 ait sshd[3187195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.199.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.42.52.9
description:
[2025-01-27 19:59:42 +0100] info [webmaild] 5.42.52.9 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
description:
2025-01-27 19:59:44 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:64762: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.61.61.19
description:
Jan 27 19:59:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.61.61.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-01-27 20:00:03 dovecot_login authenticator failed for (bd064eb6.virtua.com.br) [189.6.78.182]:39591: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/engine1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Jan 27 20:00:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 149.28.70.75
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-00.149.28.70.75


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.154.199.12
description:
Jan 27 19:59:20 ait sshd[3187195]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.154.199.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.61.61.19
description:
2025-01-27 19:59:54 dovecot_plain authenticator failed for ([45.61.61.19]) [45.61.61.19]:46116: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.110.127.224
description:
2025-01-27 20:00:06 dovecot_plain authenticator failed for ([183.71.251.66]) [14.110.127.224]:38055: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.115.208
description:
Jan 27 20:00:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.115.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
description:
2025-01-27 20:00:13 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:54714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.212
description:
2025-01-27 19:59:18 dovecot_login authenticator failed for ([195.178.110.212]) [195.178.110.212]:59870: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
description:
Jan 27 19:59:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.225.211.21
description:
[2025-01-27 20:00:56 +0100] info [webmaild] 45.225.211.21 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/js/engine1/data1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
description:
2025-01-27 20:00:34 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:36668: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Jan 27 20:00:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
description:
Jan 27 20:00:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-01-27 20:00:49 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:55852: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 20:00:16 ait sshd[3187768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 20:00:16 ait sshd[3187768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
description:
Jan 27 20:02:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/css/engine1/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 27 20:01:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-27 20:01:43 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:47310: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 27 20:01:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-27 20:01:18 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:60832: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
description:
Jan 27 20:01:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
description:
2025-01-27 20:01:33 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:55778: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-27 20:01:46 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:63646: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 27 20:02:01 ait sshd[3188712]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
description:
2025-01-27 20:02:14 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:42508: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-27 20:01:31 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:57415: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 27 20:01:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 27 20:02:01 ait sshd[3188712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-01-27 20:02:23 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:34296: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/data1/js/js/data1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 20:02:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 20:02:51 ait sshd[3189169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
description:
Jan 27 20:02:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.65.164.162
description:
Jan 27 20:02:31 ait sshd[3189086]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.65.164.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.65.164.162
description:
Jan 27 20:02:31 ait sshd[3189086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.65.164.162


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Jan 27 20:02:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
description:
Jan 27 20:02:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
description:
2025-01-27 20:02:34 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:38882: 535 Incorrect authentication data (set_id=ads20b00337y)


