# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.70.194.213
description:
[2025-01-30 17:02:54 +0100] info [webmaild] 177.70.194.213 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.136
description:
Jan 30 17:03:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.136
description:
2025-01-30 17:03:13 dovecot_login authenticator failed for ([104.241.231.136]) [104.241.231.136]:57598: 535 Incorrect authentication data (set_id=ads32b11283y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-30 17:03:00 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:44115: 535 Incorrect authentication data (set_id=ads32b11283y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-01-30 17:03:00 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:33485: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.42.37.26
description:
[2025-01-30 17:03:06 +0100] info [webmaild] 31.42.37.26 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Jan 30 17:03:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-01-30 17:03:10 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:4538: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 30 17:04:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.242.122
description:
Jan 30 17:04:43 ait sshd[1042128]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.207.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.207.242.122
description:
Jan 30 17:04:43 ait sshd[1042128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.207.242.122


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 17:04:01 ait sshd[1041847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 17:04:01 ait sshd[1041847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.194.8.14
description:
[2025-01-30 17:04:00 +0100] info [webmaild] 185.194.8.14 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 17:04:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
description:
Jan 30 17:04:01 ait sshd[1041847]: Invalid user universitypublishing from 211.108.234.111 port 45422


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-30 17:04:20 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:53996: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.179.142
description:
Jan 30 17:04:24 ait sshd[1041997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.179.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Jan 30 17:04:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-01-30 17:04:09 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:37580: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.84.107.245
description:
Jan 30 17:05:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.84.107.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Jan 30 17:05:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.35.179.142
description:
Jan 30 17:05:38 ait sshd[1042776]: Failed password for invalid user debian from 161.35.179.142 port 59074 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 30 17:05:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
description:
2025-01-30 17:05:50 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:58478: 535 Incorrect authentication data (set_id=ads21b11212y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Jan 30 17:05:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
description:
Jan 30 17:05:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-30 17:05:50 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:41833: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-01-30 17:05:35 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:35174: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-01-30 17:05:37 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:58263: 535 Incorrect authentication data (set_id=bscj21bit1157y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-30 17:05:24 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:51910: 535 Incorrect authentication data (set_id=bscj21bit1157y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 30 17:05:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.84.107.245
description:
2025-01-30 17:05:30 dovecot_login authenticator failed for ([220.84.107.245]) [220.84.107.245]:51276: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.179.142
description:
Jan 30 17:05:36 ait sshd[1042776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.179.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.233.92.37
description:
Jan 30 17:06:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.233.92.37 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 30 17:06:30 ait sshd[1043241]: Invalid user universitypublishing from 175.126.195.176 port 53968


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 17:06:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.202.108.31
description:
[2025-01-30 17:06:54 +0100] info [cpaneld] 185.202.108.31 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.242.122
description:
Jan 30 17:06:19 ait sshd[1043168]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.207.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 17:06:30 ait sshd[1043241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.153.114.124
description:
Jan 30 17:06:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.153.114.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.207.242.122
description:
Jan 30 17:06:19 ait sshd[1043168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.207.242.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.233.92.37
description:
2025-01-30 17:06:26 dovecot_login authenticator failed for ([127.0.0.1]) [188.233.92.37]:54518: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 17:06:30 ait sshd[1043241]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.153.114.124
description:
2025-01-30 17:06:38 dovecot_login authenticator failed for ([127.0.0.1]) [218.153.114.124]:3332: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.68.162.19
description:
[2025-01-30 17:06:08 +0100] info [webmaild] 200.68.162.19 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.102
description:
2025-01-30 17:07:02 dovecot_plain authenticator failed for 110-25-104-102.adsl.fetnet.net [110.25.104.102]:51628: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.162.234
description:
[2025-01-30 17:07:06 +0100] info [webmaild] 168.232.162.234 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 17:07:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
description:
Jan 30 17:07:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
description:
2025-01-30 17:07:13 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:40192: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.107.43
description:
Jan 30 17:07:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.107.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 30 17:07:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-30 17:07:42 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:60806: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.30.141.222
description:
Jan 30 17:07:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.30.141.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.102
description:
Jan 30 17:07:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.43
description:
2025-01-30 17:07:21 dovecot_plain authenticator failed for 110-25-107-43.adsl.fetnet.net [110.25.107.43]:37771: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.49.89.41
description:
[2025-01-30 17:07:22 +0100] info [webmaild] 190.49.89.41 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 30 17:08:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
description:
2025-01-30 17:08:58 dovecot_login authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:52584: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.30.141.222
description:
2025-01-30 17:08:00 dovecot_login authenticator failed for ([58.30.141.222]) [58.30.141.222]:57282: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-08.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Jan 30 17:08:15 ait sshd[1044070]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Jan 30 17:08:15 ait sshd[1044070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.249.189
description:
[2025-01-30 17:08:15 +0100] info [webmaild] 177.129.249.189 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-30 17:08:47 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:37222: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.189
description:
Jan 30 17:08:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 30 17:08:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 30 17:08:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 17:08:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-30 17:08:55 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:50616: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-30 17:08:12 dovecot_login authenticator failed for ([2.57.219.14]) [2.57.219.2]:33654: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.176.67
description:
Jan 30 17:09:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 17:09:42 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:46410: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-30 17:09:06 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:53462: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Jan 30 17:09:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 17:09:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
description:
Jan 30 17:09:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 17:09:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 17:09:29 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (walmoroz) [51.255.84.180]:55360: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-09.147.135.223.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.176.67
description:
2025-01-30 17:09:50 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.176.67]:52441: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.116.195.203
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-09.185.116.195.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.129.114
description:
2025-01-30 17:09:58 dovecot_login authenticator failed for ([14.48.129.114]) [14.48.129.114]:46522: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.153.186.191
description:
Jan 30 17:10:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.153.186.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.135.6.10
description:
Jan 30 17:10:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.135.6.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.237.145
description:
2025-01-30 17:10:11 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.237.145]:24816: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 30 17:10:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-30 17:10:42 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:27883: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.220.58
description:
[2025-01-30 17:10:31 +0100] info [webmaild] 177.84.220.58 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.186.191
description:
2025-01-30 17:10:51 dovecot_login authenticator failed for m106153186191.v4.enabler.ne.jp [106.153.186.191]:49778: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.145
description:
Jan 30 17:10:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 30 17:12:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.59.3.136
description:
2025-01-30 17:12:01 dovecot_login authenticator failed for ([192.168.80.12]) [181.59.3.136]:20329: 535 Incorrect authentication data (set_id=pg23j2050045@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-30 17:12:03 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:39069: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Jan 30 17:12:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-01-30 17:12:05 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:33602: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.201.55.127
description:
[2025-01-30 17:12:45 +0100] info [webmaild] 109.201.55.127 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-30 17:13:45 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:36550: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 30 17:13:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
description:
Jan 30 17:13:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Jan 30 17:13:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.35.211
description:
Jan 30 17:13:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-30 17:13:27 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:50624: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.54.70.126
description:
Jan 30 17:13:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.54.70.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.78.179.108
description:
Jan 30 17:13:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.78.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.78.179.108
description:
2025-01-30 17:13:52 dovecot_plain authenticator failed for ([220.78.179.108]) [220.78.179.108]:48591: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-30 17:13:59 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:55990: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.35.211
description:
2025-01-30 17:13:22 dovecot_login authenticator failed for ([127.0.0.1]) [37.25.35.211]:37151: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 17:13:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.70.126
description:
2025-01-30 17:13:36 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.70.126]:58760: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 30 17:13:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-01-30 17:14:00 dovecot_plain authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:57436: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 17:14:45 ait sshd[1046977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.238.90
description:
Jan 30 17:14:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.238.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.238.90
description:
2025-01-30 17:14:29 dovecot_plain authenticator failed for ([122.187.147.17]) [128.185.238.90]:51352: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 17:14:45 ait sshd[1046977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.209
description:
Jan 30 17:14:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Jan 30 17:14:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 30 17:14:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-30 17:14:20 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:54934: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
description:
2025-01-30 17:14:11 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:55039: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
description:
2025-01-30 17:14:50 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:59346: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-01-30 17:15:16 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:45432: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
description:
2025-01-30 17:15:18 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:59378: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 30 17:15:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.49.39
description:
[2025-01-30 17:15:57 +0100] info [webmaild] 201.182.49.39 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Jan 30 17:15:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 30 17:15:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
description:
2025-01-30 17:15:35 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:52408: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-30 17:15:36 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:37998: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.10.20
description:
Jan 30 17:15:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.10.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.144.33.209
description:
Jan 30 17:15:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.144.33.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-01-30 17:15:04 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:33778: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 17:15:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-30 17:15:45 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:55359: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.208.58.227
description:
[2025-01-30 17:15:01 +0100] info [webmaild] 154.208.58.227 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
description:
Jan 30 17:15:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.206.141.204
description:
[2025-01-30 17:16:11 +0100] info [webmaild] 31.206.141.204 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Jan 30 17:16:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 30 17:16:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-30 17:16:24 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:41040: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 17:16:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-01-30 17:16:17 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:57464: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 17:16:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 30 17:17:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.161.183
description:
Jan 30 17:17:26 ait sshd[1048613]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.161.183 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.161.183
description:
Jan 30 17:17:26 ait sshd[1048613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.183  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 17:17:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.212.203.231
description:
[2025-01-30 17:17:01 +0100] info [webmaild] 177.212.203.231 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.57.70.22
description:
2025-01-30 17:17:01 dovecot_login authenticator failed for (host-216-57-70-22-cal.net) [216.57.70.22]:39604: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Jan 30 17:17:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
description:
Jan 30 17:17:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 30 17:17:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
description:
2025-01-30 17:17:57 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:57392: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-01-30 17:17:59 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:34560: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 143.198.188.191
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-17.143.198.188.191


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-30 17:17:20 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:46580: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
description:
2025-01-30 17:17:44 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:45912: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.57.70.22
description:
Jan 30 17:16:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.57.70.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.161.183
description:
Jan 30 17:18:15 ait sshd[1049116]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.161.183 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.161.183
description:
Jan 30 17:18:15 ait sshd[1049116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.183  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 30 17:18:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-30 17:18:25 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:46169: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 30 17:18:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 30 17:18:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.13.236.78
description:
[2025-01-30 17:18:57 +0100] info [webmaild] 187.13.236.78 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-30 17:18:29 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:37201: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
description:
2025-01-30 17:18:54 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:40943: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.177.215.47
description:
Jan 30 17:19:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.177.215.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-30 17:19:59 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:48818: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.244.68.3
description:
2025-01-30 17:19:12 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:45765: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 30 17:19:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Jan 30 17:19:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 30 17:19:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 30 17:19:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-01-30 17:19:38 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:59082: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-30 17:19:25 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:56090: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Jan 30 17:19:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-30 17:19:37 dovecot_plain authenticator failed for (bumprochae) [94.140.210.134]:50063: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
description:
2025-01-30 17:19:24 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:49806: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 30 17:19:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.162.103
description:
[2025-01-30 17:19:56 +0100] info [webmaild] 90.156.162.103 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-01-30 17:19:58 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:56302: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 30 17:19:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 17:19:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-30 17:19:46 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:52090: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
description:
2025-01-30 17:19:21 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:55172: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
description:
Jan 30 17:19:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 30 17:19:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.177.215.47
description:
2025-01-30 17:19:45 dovecot_plain authenticator failed for ([117.177.215.47]) [117.177.215.47]:52496: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 30 17:19:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-30 17:19:06 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:35002: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-01-30 17:20:37 dovecot_login authenticator failed for ([185.168.173.87]) [185.168.173.87]:41140: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.230.127.224
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-20.213.230.127.224


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.242
description:
Jan 30 17:20:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
description:
2025-01-30 17:20:53 dovecot_login authenticator failed for ([111.61.176.242]) [111.61.176.242]:39416: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-20.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 17:20:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
description:
Jan 30 17:20:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-30 17:20:45 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:54158: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.21.235.162
description:
Jan 30 17:20:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.21.235.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Jan 30 17:20:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
description:
2025-01-30 17:20:24 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:54297: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.14.114
description:
[2025-01-30 17:20:33 +0100] info [webmaild] 177.124.14.114 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Jan 30 17:21:52 ait sshd[1050555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.223.183.64
description:
[2025-01-30 17:21:22 +0100] info [webmaild] 186.223.183.64 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-21.103.249.112.157


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
description:
2025-01-30 17:21:37 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:44791: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-21.157.230.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-30 17:21:29 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:51716: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.35.18
description:
Jan 30 17:21:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.35.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 30 17:21:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-30 17:21:47 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:40162: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 30 17:21:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Jan 30 17:21:52 ait sshd[1050555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.6.212.150
description:
Jan 30 17:22:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.6.212.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.6.212.150
description:
2025-01-30 17:22:06 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.212.150]:35866: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 30 17:22:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-30 17:22:18 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:44426: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 30 17:22:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 30 17:22:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.8.65
description:
Jan 30 17:22:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.8.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-30 17:22:09 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:53220: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.8.65
description:
2025-01-30 17:22:02 dovecot_login authenticator failed for (mail.phongphucorp.com) [14.161.8.65]:41793: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 17:22:15 ait sshd[1050876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 17:22:15 ait sshd[1050876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-30 17:22:19 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:40759: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 30 17:23:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-30 17:23:58 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:8843: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.98.21.72
description:
[2025-01-30 17:23:02 +0100] info [webmaild] 176.98.21.72 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.35.67.176
description:
[2025-01-30 17:24:00 +0100] info [webmaild] 37.35.67.176 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
description:
Jan 30 17:24:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.101.77
description:
2025-01-30 17:24:17 dovecot_plain authenticator failed for ([112.26.101.77]) [112.26.101.77]:56601: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.245.111.51
description:
[2025-01-30 17:24:34 +0100] info [webmaild] 109.245.111.51 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 30 17:24:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-30 17:24:46 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (batong) [81.16.170.117]:39100: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.252.105
description:
[2025-01-30 17:25:23 +0100] info [webmaild] 170.83.252.105 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.125.32
description:
47.128.125.32 - - [30/Jan/2025:17:25:38 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29009966 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/file.php/1/OUM_UNDERGRAD_Sample_Proposal.pptx" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.125.32


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.73.42.142
description:
Jan 30 17:25:43 ait sshd[1053113]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.73.42.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.73.42.142
description:
Jan 30 17:25:43 ait sshd[1053113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.73.42.142  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-01-30 17:26:35 dovecot_login authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:39300: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
description:
2025-01-30 17:26:43 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:48726: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Jan 30 17:26:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-01-30 17:26:27 dovecot_login authenticator failed for ([23.94.179.104]) [23.94.179.104]:57558: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Jan 30 17:26:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.73.42.142
description:
Jan 30 17:27:26 ait sshd[1054079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.73.42.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.78.211
description:
[2025-01-30 17:27:26 +0100] info [webmaild] 84.54.78.211 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-30 17:27:04 dovecot_login authenticator failed for ([175.210.74.19]) [175.210.74.19]:32876: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.73.42.142
description:
Jan 30 17:27:26 ait sshd[1054079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.73.42.142


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-27.147.135.223.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.241.115
description:
[2025-01-30 17:28:37 +0100] info [webmaild] 45.228.241.115 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-30 17:28:43 dovecot_plain authenticator failed for ([186.200.158.42]) [186.200.158.42]:39217: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.73.42.142
description:
Jan 30 17:28:32 ait sshd[1054777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.73.42.142


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 206.183.128.159
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-28.206.183.128.159


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.73.42.142
description:
Jan 30 17:28:32 ait sshd[1054777]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.73.42.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-01-30 17:28:29 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:58568: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
description:
Jan 30 17:28:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
description:
2025-01-30 17:28:55 dovecot_plain authenticator failed for (trade) [37.139.110.118]:35769: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Jan 30 17:28:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.16.30.187
description:
[2025-01-30 17:28:30 +0100] info [webmaild] 185.16.30.187 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 17:29:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 17:29:21 dovecot_plain authenticator failed for (unporcatic) [46.30.161.197]:38089: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.43.11
description:
[2025-01-30 17:29:32 +0100] info [webmaild] 177.22.43.11 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.134.180
description:
2025-01-30 17:31:15 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.134.180]:34427: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
description:
Jan 30 17:31:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.187.106.53
description:
Jan 30 17:31:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.187.106.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.134.180
description:
Jan 30 17:31:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.134.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
description:
2025-01-30 17:31:17 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:54102: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.187.106.53
description:
2025-01-30 17:31:23 dovecot_login authenticator failed for ([127.0.0.1]) [113.187.106.53]:38894: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.172.26
description:
[2025-01-30 17:31:36 +0100] info [webmaild] 181.115.172.26 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-31.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.221.198.75
description:
Jan 30 17:31:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.221.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.198.75
description:
2025-01-30 17:31:03 dovecot_plain authenticator failed for ([185.221.198.75]) [185.221.198.75]:51992: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.128.195
description:
[2025-01-30 17:32:35 +0100] info [webmaild] 45.171.128.195 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.251.151
description:
Jan 30 17:32:53 ait sshd[1057178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.251.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.251.151
description:
Jan 30 17:32:53 ait sshd[1057178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.251.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.70.85
description:
[2025-01-30 17:32:57 +0100] info [webmaild] 170.245.70.85 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 116.198.252.161
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-33.116.198.252.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-30 17:33:31 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:16384: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.115.110.230
description:
[2025-01-30 17:33:47 +0100] info [webmaild] 189.115.110.230 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-30 17:33:15 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:54978: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 30 17:33:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 30 17:34:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.226.64.124
description:
Jan 30 17:34:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.226.64.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.116.41.2
description:
Jan 30 17:34:51 ait sshd[1058360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.116.41.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.57.131
description:
47.128.57.131 - - [30/Jan/2025:17:34:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9104220 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/11/?filter_course-language=120&filtering=1&instructor=2&level=intermediate%2Cbeginner%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.57.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-30 17:34:30 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:43030: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.21.254.67
description:
2025-01-30 17:34:32 dovecot_login authenticator failed for ([127.0.0.1]) [37.21.254.67]:43123: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.226.64.124
description:
2025-01-30 17:34:41 dovecot_login authenticator failed for ([127.0.0.1]) [14.226.64.124]:51142: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.21.254.67
description:
Jan 30 17:34:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.21.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.116.41.2
description:
Jan 30 17:34:51 ait sshd[1058360]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.116.41.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Jan 30 17:35:07 ait sshd[1058655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-01-30 17:35:25 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:32997: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.54.174.3
description:
[2025-01-30 17:35:39 +0100] info [webmaild] 2.54.174.3 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
description:
2025-01-30 17:35:36 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:50250: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-01-30 17:35:48 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:37480: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Jan 30 17:35:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
description:
Jan 30 17:35:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Jan 30 17:35:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Jan 30 17:35:07 ait sshd[1058655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.209.173.203
description:
Jan 30 17:35:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.209.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.209.173.203
description:
2025-01-30 17:35:14 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:52000: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Jan 30 17:36:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.216.133.193
description:
[2025-01-30 17:36:35 +0100] info [webmaild] 91.216.133.193 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-01-30 17:36:02 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:41598: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
description:
2025-01-30 17:36:31 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (shish) [80.14.31.158]:49229: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
description:
Jan 30 17:36:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 98.97.79.239
description:
[2025-01-30 17:37:13 +0100] info [webmaild] 98.97.79.239 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.52
description:
47.128.16.52 - - [30/Jan/2025:17:37:22 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18737251 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?filtering=1&instructor=2&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-01-30 17:38:14 dovecot_login authenticator failed for 93-56-11-148.ip287.fastwebnet.it ([127.0.0.1]) [93.56.11.148]:48770: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.34.147
description:
Jan 30 17:38:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.34.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.56.11.148
description:
Jan 30 17:38:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.56.11.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.116.41.2
description:
Jan 30 17:38:12 ait sshd[1059854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.116.41.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.56.124
description:
47.128.56.124 - - [30/Jan/2025:17:38:11 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27734948 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?filtering=1&instructor=2&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.56.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Jan 30 17:38:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.251.151
description:
Jan 30 17:38:02 ait sshd[1059775]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.251.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.251.151
description:
Jan 30 17:38:02 ait sshd[1059775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.251.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-01-30 17:38:56 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:53926: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.116.41.2
description:
Jan 30 17:38:12 ait sshd[1059854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.116.41.2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.78.177
description:
[2025-01-30 17:38:18 +0100] info [webmaild] 179.60.78.177 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-30 17:38:21 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:35615: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.251.151
description:
Jan 30 17:39:36 ait sshd[1060717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.251.151


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.251.151
description:
Jan 30 17:39:38 ait sshd[1060717]: Failed password for invalid user user1 from 216.10.251.151 port 38646 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
description:
2025-01-30 17:39:42 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:52930: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.145.251
description:
2025-01-30 17:39:57 dovecot_plain authenticator failed for ([183.245.145.251]) [183.245.145.251]:36759: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-30 17:39:17 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46024: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-01-30 17:39:04 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:46346: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.148.41
description:
Jan 30 17:39:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.148.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 30 17:39:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.148.41
description:
2025-01-30 17:39:17 dovecot_plain authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:50234: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 30 17:39:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-30 17:39:30 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:48299: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Jan 30 17:39:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.251.151
description:
Jan 30 17:39:36 ait sshd[1060717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.251.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
description:
Jan 30 17:39:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.116.41.2
description:
Jan 30 17:39:40 ait sshd[1060778]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.116.41.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.212.118.59
description:
[2025-01-30 17:39:54 +0100] info [webmaild] 177.212.118.59 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.145.251
description:
Jan 30 17:39:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.145.251 has been locked due to Imunify RBL


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.232
description:
Jan 30 17:39:13 ait dovecot[577694]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.232, lip=136.243.145.84, TLS, session=<LD/yEO8sp4lX7LDo>


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.102.11
description:
Jan 30 17:39:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.116.41.2
description:
Jan 30 17:39:40 ait sshd[1060778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.116.41.2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
description:
2025-01-30 17:39:19 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:8830: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.93.191.100
description:
[2025-01-30 17:40:51 +0100] info [webmaild] 109.93.191.100 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 17:40:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
description:
Jan 30 17:40:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
description:
2025-01-30 17:40:45 dovecot_plain authenticator failed for (flobly) [65.20.200.71]:57689: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 17:41:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.139.80
description:
Jan 30 17:41:38 ait sshd[1061955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.139.80


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 113.21.228.124
description:
[2025-01-30 17:41:32 +0100] info [webmaild] 113.21.228.124 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.90.129.81
description:
[2025-01-30 17:41:23 +0100] info [whostmgrd] 164.90.129.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.167.150
description:
[2025-01-30 17:42:21 +0100] info [webmaild] 177.131.167.150 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 30 17:42:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
description:
2025-01-30 17:42:58 dovecot_plain authenticator failed for data.autofrant.ru (yableatted) [151.248.116.230]:50752: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 17:42:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 91.246.51.41
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads17b00155y@ait.edu.gh||WPU:ads17b00155y@ait.edu.gh||RSV:6.65||T:APACHE||MV:17-42.91.246.51.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 17:42:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.34.26
description:
2025-01-30 17:42:17 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:54885: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 17:42:02 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2212: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-43.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-30 17:43:48 dovecot_plain authenticator failed for (gantal) [88.87.84.104]:53420: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.127.208.241
description:
[2025-01-30 17:43:57 +0100] info [webmaild] 79.127.208.241 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Jan 30 17:44:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 30 17:44:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
description:
Jan 30 17:44:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.239.135.150
description:
2025-01-30 17:44:16 dovecot_login authenticator failed for ([127.0.0.1]) [169.239.135.150]:55628: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-30 17:44:07 dovecot_login authenticator failed for ([127.0.0.1]) [218.78.92.131]:55682: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
description:
2025-01-30 17:44:07 dovecot_login authenticator failed for 161.sm-u1.dialup.garlic.net ([127.0.0.1]) [216.139.35.161]:41146: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 17:44:10 ait sshd[1063512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 17:44:10 ait sshd[1063512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
description:
2025-01-30 17:44:18 dovecot_login authenticator failed for ([127.0.0.1]) [121.44.217.237]:60664: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 17:44:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.214.211.210
description:
[2025-01-30 17:44:54 +0100] info [webmaild] 95.214.211.210 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 17:45:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.71.170.45
description:
[2025-01-30 17:45:36 +0100] info [webmaild] 186.71.170.45 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 17:46:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.84.121
description:
[2025-01-30 17:46:26 +0100] info [webmaild] 186.235.84.121 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 30 17:46:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-30 17:46:46 dovecot_plain authenticator failed for (bemothiry) [62.231.31.86]:52113: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 17:47:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.141.241.229
description:
Jan 30 17:47:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.141.241.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
description:
2025-01-30 17:47:40 dovecot_login authenticator failed for 229.sub-166-141-241.myvzw.com [166.141.241.229]:58682: 535 Incorrect authentication data (set_id=ads76b66779y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.98.163.12
description:
[2025-01-30 17:47:55 +0100] info [webmaild] 177.98.163.12 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.239.160.200
description:
2025-01-30 17:48:55 dovecot_login authenticator failed for ([218.239.160.200]) [218.239.160.200]:40693: 535 Incorrect authentication data (set_id=jaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 30 17:48:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
description:
2025-01-30 17:48:05 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:19426: 535 Incorrect authentication data (set_id=ads76b66779y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
description:
Jan 30 17:48:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-01-30 17:48:19 dovecot_login authenticator failed for ([189.108.24.17]) [200.148.173.150]:51677: 535 Incorrect authentication data (set_id=jaster@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
description:
Jan 30 17:48:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-30 17:48:25 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:55570: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.35
description:
[2025-01-30 17:48:51 +0100] info [webmaild] 198.163.193.35 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.248
description:
47.128.52.248 - - [30/Jan/2025:17:49:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10363542 HTTP/2.0" 302 0 ait-ext.com "https://ait-ext.com/udesk/public/en/customer/create-ticket/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.248


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.40.121
description:
[2025-01-30 17:49:34 +0100] info [webmaild] 177.221.40.121 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 17:49:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
description:
2025-01-30 17:50:04 dovecot_plain authenticator failed for ([82.193.121.147]) [82.193.121.147]:46311: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.251.107
description:
2025-01-30 17:50:15 dovecot_plain authenticator failed for ([14.48.251.107]) [14.48.251.107]:46615: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.5.71
description:
[2025-01-30 17:50:39 +0100] info [webmaild] 168.196.5.71 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.161.72.119
description:
2025-01-30 17:51:53 dovecot_login authenticator failed for (mail.phongphucorp.com) [113.161.72.119]:44133: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-30 17:51:55 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (action) [81.225.30.107]:56664: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 30 17:51:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.235.203
description:
Jan 30 17:51:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.235.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.235.203
description:
2025-01-30 17:51:32 dovecot_login authenticator failed for p101203-obmd01.tokyo.ocn.ne.jp [124.101.235.203]:54403: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.150.37.249
description:
2025-01-30 17:51:33 dovecot_plain authenticator failed for ([217.150.37.249]) [217.150.37.249]:60180: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.47.63.37
description:
2025-01-30 17:51:39 dovecot_plain authenticator failed for ([95.47.63.37]) [95.47.63.37]:49548: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 30 17:51:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-01-30 17:51:57 dovecot_login authenticator failed for ([72.26.178.196]) [72.26.178.196]:49594: 535 Incorrect authentication data (set_id=ads39a22282y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.238.222
description:
[2025-01-30 17:52:00 +0100] info [webmaild] 45.174.238.222 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 30 17:52:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 30 17:52:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 30 17:52:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.30.24
description:
Jan 30 17:52:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.30.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-30 17:52:01 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:58220: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.30.24
description:
2025-01-30 17:52:03 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:53223: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.153.186.191
description:
Jan 30 17:52:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.153.186.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-30 17:52:31 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:11730: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-30 17:52:09 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:43232: 535 Incorrect authentication data (set_id=ads39a22282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.186.191
description:
2025-01-30 17:52:15 dovecot_login authenticator failed for m106153186191.v4.enabler.ne.jp [106.153.186.191]:46818: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 30 17:52:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-30 17:52:03 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:40711: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-30 17:52:44 dovecot_login authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:7708: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.95.223.139
description:
Jan 30 17:53:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.95.223.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.206.202
description:
2025-01-30 17:53:25 dovecot_login authenticator failed for ([127.0.0.1]) [120.157.206.202]:44132: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.95.223.139
description:
2025-01-30 17:53:03 dovecot_login authenticator failed for ([36.95.223.139]) [36.95.223.139]:53557: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.139.80
description:
Jan 30 17:53:18 ait sshd[1068145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.139.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.157.206.202
description:
Jan 30 17:53:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.157.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
description:
Jan 30 17:53:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.255.128.236
description:
[2025-01-30 17:53:04 +0100] info [webmaild] 187.255.128.236 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.60.142
description:
Jan 30 17:53:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.60.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.60.142
description:
2025-01-30 17:53:19 dovecot_login authenticator failed for ([14.195.61.172]) [14.195.60.142]:51382: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.73.86
description:
2025-01-30 17:53:38 dovecot_login authenticator failed for ([127.0.0.1]) [95.52.73.86]:40801: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
description:
2025-01-30 17:53:54 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:34118: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.73.86
description:
Jan 30 17:53:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.73.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.242.183
description:
[2025-01-30 17:53:42 +0100] info [webmaild] 170.233.242.183 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Jan 30 17:54:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 30 17:54:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-30 17:54:23 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:53161: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.139.80
description:
Jan 30 17:54:46 ait sshd[1069192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.139.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
description:
Jan 30 17:54:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
description:
2025-01-30 17:54:07 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:36618: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-01-30 17:54:23 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:43034: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
description:
2025-01-30 17:54:25 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:52623: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
description:
2025-01-30 17:54:03 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:36568: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Jan 30 17:54:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
description:
Jan 30 17:54:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.172.132
description:
[2025-01-30 17:54:32 +0100] info [webmaild] 177.37.172.132 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 30 17:54:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-30 17:54:14 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:46920: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 30 17:54:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-30 17:54:41 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:38582: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 30 17:55:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
description:
2025-01-30 17:55:52 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:39778: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 30 17:55:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-30 17:55:55 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:7411: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-55.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.110.194
description:
2025-01-30 17:56:11 dovecot_login authenticator failed for host194.sub-63-46-110.myvzw.com [63.46.110.194]:59894: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.57.151.179
description:
[2025-01-30 17:56:17 +0100] info [webmaild] 190.57.151.179 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 30 17:56:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-30 17:56:21 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:51362: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 30 17:56:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-30 17:56:28 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:49022: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.110.194
description:
Jan 30 17:56:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.110.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
description:
2025-01-30 17:57:14 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:50961: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.2.133
description:
[2025-01-30 17:57:45 +0100] info [webmaild] 169.224.2.133 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.133
description:
2025-01-30 17:57:49 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:36278: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 30 17:57:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Jan 30 17:57:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-01-30 17:57:03 dovecot_login authenticator failed for ([203.193.168.181]) [203.193.168.181]:47478: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-30 17:57:16 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:34796: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-30 17:57:25 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:56486: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-30 17:57:53 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:56258: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
description:
Jan 30 17:57:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-01-30 17:58:00 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:39480: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.38.95.251
description:
[2025-01-30 17:57:08 +0100] info [webmaild] 102.38.95.251 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
description:
Jan 30 17:57:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 30 17:57:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 30 17:57:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-30 17:57:58 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:40770: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 30 17:57:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.133
description:
Jan 30 17:57:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
description:
2025-01-30 17:58:34 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:35768: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-30 17:58:55 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:60934: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-30 17:58:11 dovecot_login authenticator failed for ([147.235.97.158]) [147.235.97.158]:20133: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Jan 30 17:58:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.111.171
description:
[2025-01-30 17:58:39 +0100] info [webmaild] 138.186.111.171 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
description:
Jan 30 17:58:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 30 17:58:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 30 17:58:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.21.235.162
description:
Jan 30 17:58:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.21.235.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Jan 30 17:58:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-30 17:58:18 dovecot_login authenticator failed for ([211.107.21.221]) [121.168.116.150]:60106: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-01-30 17:58:38 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:36197: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
description:
2025-01-30 17:58:49 dovecot_login authenticator failed for (hn.kd.ny.adsl) [219.157.124.84]:58197: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 30 17:59:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 17:59:20 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:63809: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.8.150
description:
2025-01-30 17:59:31 dovecot_login authenticator failed for ([190.61.8.150]) [190.61.8.150]:45975: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-30 17:59:32 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:40928: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.81.144.215
description:
[2025-01-30 17:59:55 +0100] info [cpaneld] 185.81.144.215 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 30 17:59:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 30 17:59:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.211.128
description:
Jan 30 17:59:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.211.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.211.128
description:
2025-01-30 17:59:37 dovecot_plain authenticator failed for ([113.64.211.128]) [113.64.211.128]:54877: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-30 17:59:09 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:46438: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 30 17:59:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-30 17:59:27 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:7400: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.61.8.150
description:
Jan 30 17:59:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.61.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
description:
2025-01-30 18:00:17 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:42831: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
description:
Jan 30 18:00:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
description:
2025-01-30 18:00:05 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:38168: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.44.43
description:
[2025-01-30 18:00:12 +0100] info [webmaild] 181.199.44.43 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
description:
Jan 30 18:00:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 18:01:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 30 18:01:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
description:
2025-01-30 18:01:44 dovecot_login authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:24597: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
description:
Jan 30 18:01:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.120.10
description:
[2025-01-30 18:01:11 +0100] info [webmaild] 45.171.120.10 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Jan 30 18:01:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 30 18:01:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-30 18:01:42 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:48676: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-30 18:01:24 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:56020: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-01-30 18:01:28 dovecot_login authenticator failed for ([115.23.241.161]) [115.23.241.161]:46352: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 18:01:33 dovecot_plain authenticator failed for (agulvers) [46.30.161.197]:43314: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.121.98.158
description:
[2025-01-30 18:01:40 +0100] info [webmaild] 168.121.98.158 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 30 18:02:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-01-30 18:02:56 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:40800: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-01-30 18:02:57 dovecot_plain authenticator failed for (colast) [65.20.194.40]:39867: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 30 18:02:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-30 18:02:24 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:39300: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.157.32.129
description:
Jan 30 18:02:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.157.32.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.157.32.129
description:
2025-01-30 18:02:41 dovecot_login authenticator failed for ([41.157.32.129]) [41.157.32.129]:50546: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.27.56
description:
[2025-01-30 18:02:30 +0100] info [webmaild] 167.250.27.56 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 18:02:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Jan 30 18:02:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.40
description:
Jan 30 18:02:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 30 18:02:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-30 18:02:09 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:53830: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-30 18:02:23 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:51446: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 30 18:02:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-30 18:02:37 dovecot_login authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:36936: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 30 18:03:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-30 18:03:43 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:49813: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 30 18:03:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-30 18:03:28 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:51881: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-30 18:04:12 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:54404: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 30 18:04:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-30 18:04:22 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:35334: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 18:04:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:04:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 18:04:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 30 18:04:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 30 18:04:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-30 18:04:55 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:42176: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 30 18:04:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.182.151.162
description:
[2025-01-30 18:04:15 +0100] info [webmaild] 103.182.151.162 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 30 18:05:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-30 18:05:15 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:55245: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 30 18:05:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-01-30 18:05:03 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:42068: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 30 18:05:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 30 18:05:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.97.205.124
description:
[2025-01-30 18:05:14 +0100] info [webmaild] 102.97.205.124 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Jan 30 18:05:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Jan 30 18:05:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-30 18:05:25 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38642: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.233.26.36
description:
[2025-01-30 18:05:49 +0100] info [webmaild] 181.233.26.36 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.173.101.197
description:
[2025-01-30 18:06:37 +0100] info [webmaild] 46.173.101.197 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 30 18:06:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 30 18:06:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-30 18:06:42 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:59038: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-30 18:06:19 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:36669: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.13
description:
2025-01-30 18:07:20 dovecot_login authenticator failed for 013.143.48.116.static.netvigator.com [116.48.143.13]:54836: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 18:07:42 ait sshd[1075246]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 18:07:42 ait sshd[1075246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.158.18.129
description:
Jan 30 18:07:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.158.18.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 30 18:07:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:07:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 18:07:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 18:07:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-07.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.13
description:
Jan 30 18:07:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.133.17.20
description:
2025-01-30 18:07:37 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:61982: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.158.18.129
description:
2025-01-30 18:07:46 dovecot_login authenticator failed for ([94.158.18.148]) [94.158.18.129]:37752: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.231.73.102
description:
[2025-01-30 18:08:13 +0100] info [webmaild] 189.231.73.102 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 30 18:09:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.255.85.211
description:
[2025-01-30 18:09:50 +0100] info [webmaild] 38.255.85.211 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.137
description:
Jan 30 18:09:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.137
description:
2025-01-30 18:09:59 dovecot_login authenticator failed for ([127.0.0.1]) [2.192.20.137]:50558: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-30 18:10:13 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:17892: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.125.99
description:
47.128.125.99 - - [30/Jan/2025:18:09:41 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18080411 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/4/?filter_course-category=205&filtering=1&level=all_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.125.99


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-30 18:09:52 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:36733: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-01-30 18:10:05 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:52356: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 30 18:10:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-30 18:10:58 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:36597: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS21A00061Y||WPU:ADS21A00061Y||RSV:6.65||T:APACHE||MV:18-11.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Jan 30 18:10:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-01-30 18:10:35 dovecot_login authenticator failed for ([116.114.97.10]) [116.114.97.10]:39601: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.39.192.94
description:
[2025-01-30 18:10:42 +0100] info [webmaild] 196.39.192.94 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
description:
Jan 30 18:10:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.5.119.122
description:
2025-01-30 18:11:31 dovecot_login authenticator failed for (ait.edu.gh) [139.5.119.122]:46490: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-01-30 18:10:46 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:59701: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 30 18:10:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 30 18:12:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 30 18:12:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-30 18:12:19 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:50504: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.64.37.40
description:
[2025-01-30 18:12:14 +0100] info [webmaild] 94.64.37.40 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.5.119.122
description:
2025-01-30 18:11:40 dovecot_plain authenticator failed for (ait.edu.gh) [139.5.119.122]:46490: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Jan 30 18:11:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.236.82.124
description:
2025-01-30 18:12:02 dovecot_login authenticator failed for (124.82.236.45.cable.dyn.ridsa.com.ar) [45.236.82.124]:33494: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-01-30 18:12:03 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:34936: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-30 18:11:49 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (saphis) [83.233.242.245]:43398: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 30 18:11:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
description:
2025-01-30 18:11:52 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:48853: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.82.124
description:
Jan 30 18:12:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.82.124 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.71.158.232
description:
[2025-01-30 18:13:11 +0100] info [webmaild] 186.71.158.232 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 30 18:13:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.225
description:
Jan 30 18:13:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.178
description:
Jan 30 18:12:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.178
description:
2025-01-30 18:12:49 dovecot_login authenticator failed for 202-4-196-178.static.pccw-hkt.com [202.4.196.178]:35067: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Jan 30 18:13:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-01-30 18:13:05 dovecot_login authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:45433: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.225
description:
2025-01-30 18:13:27 dovecot_login authenticator failed for ([104.241.231.225]) [104.241.231.225]:55374: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 30 18:13:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-30 18:13:07 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:50522: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-30 18:13:20 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:38103: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 116.90.119.150
description:
[2025-01-30 18:14:20 +0100] info [webmaild] 116.90.119.150 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 30 18:13:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-30 18:13:42 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:18900: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
description:
Jan 30 18:15:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.76.243
description:
[2025-01-30 18:15:07 +0100] info [webmaild] 45.191.76.243 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-01-30 18:15:06 dovecot_login authenticator failed for ([218.22.253.37]) [218.22.253.37]:46820: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Jan 30 18:15:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-01-30 18:15:20 dovecot_login authenticator failed for ([222.106.198.35]) [222.106.198.35]:59152: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.114.79
description:
47.128.114.79 - - [30/Jan/2025:18:14:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18733949 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=102&id=70&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-01-30 18:16:13 dovecot_login authenticator failed for ([127.0.0.1]) [102.215.188.37]:42464: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.160
description:
Jan 30 18:16:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 30 18:16:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
description:
2025-01-30 18:16:15 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:56980: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Jan 30 18:16:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 30 18:15:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-30 18:15:52 dovecot_login authenticator failed for ([221.215.87.163]) [221.215.87.163]:48282: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-30 18:16:02 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:51428: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.160
description:
2025-01-30 18:16:17 dovecot_plain authenticator failed for 202-4-196-160.static.pccw-hkt.com [202.4.196.160]:47974: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.73.86
description:
2025-01-30 18:16:21 dovecot_login authenticator failed for ([127.0.0.1]) [95.52.73.86]:46501: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-01-30 18:16:30 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:45734: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 18:15:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 30 18:16:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-30 18:16:07 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:41782: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Jan 30 18:16:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.73.86
description:
Jan 30 18:16:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.73.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.65.5.73
description:
[2025-01-30 18:16:30 +0100] info [webmaild] 178.65.5.73 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 30 18:16:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-30 18:16:55 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:58976: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-01-30 18:16:42 dovecot_login authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:48070: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.188.18.25
description:
Jan 30 18:17:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.188.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
description:
Jan 30 18:17:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 30 18:17:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Jan 30 18:16:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.144.33.209
description:
Jan 30 18:17:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.144.33.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-01-30 18:17:07 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:60441: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
description:
2025-01-30 18:17:28 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:39320: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 30 18:17:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
description:
2025-01-30 18:17:09 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:23134: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
description:
2025-01-30 18:17:18 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:5771: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
description:
Jan 30 18:17:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.173.172.73
description:
[2025-01-30 18:17:29 +0100] info [webmaild] 103.173.172.73 - demo@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.116
description:
47.128.16.116 - - [30/Jan/2025:18:17:39 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28043992 HTTP/2.0" 302 0 ait-open.net "https://ait-open.net/elearning/help.php?module=moodle&file=cookies.html&forcelang=" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 18:17:39 ait sshd[1079724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 18:17:39 ait sshd[1079724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
description:
2025-01-30 18:17:45 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:50818: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 30 18:17:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
description:
Jan 30 18:17:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.226.233
description:
Jan 30 18:18:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.226.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.226.233
description:
2025-01-30 18:18:06 dovecot_login authenticator failed for d-138-207-226-233.ct.cpe.atlanticbb.net [138.207.226.233]:55835: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 180.149.234.2
description:
[2025-01-30 18:18:17 +0100] info [webmaild] 180.149.234.2 - demo@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.214.84
description:
2025-01-30 18:18:46 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.214.84]:55383: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.163.129.210
description:
[2025-01-30 18:19:08 +0100] info [webmaild] 109.163.129.210 - demo@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Jan 30 18:19:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
description:
2025-01-30 18:18:40 dovecot_login authenticator failed for ([127.0.0.1]) [120.57.33.221]:53134: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-19.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.74.190.140
description:
[2025-01-30 18:20:30 +0100] info [webmaild] 213.74.190.140 - demo@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-01-30 18:19:33 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:40634: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Jan 30 18:19:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:19:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-01-30 18:19:44 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:43255: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.135.6.10
description:
Jan 30 18:21:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.135.6.10 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 160.251.148.126
domain: a-rapp.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-20.160.251.148.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.247
description:
Jan 30 18:21:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-01-30 18:21:29 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.142.238]:31756: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
description:
2025-01-30 18:21:32 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:58454: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-30 18:20:56 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:53086: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.78
description:
Jan 30 18:20:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
description:
2025-01-30 18:21:01 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:43804: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.4.84.125
description:
Jan 30 18:21:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.4.84.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
description:
2025-01-30 18:21:18 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:31161: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.84.125
description:
2025-01-30 18:21:25 dovecot_login authenticator failed for d4-50-125-84.nap.wideopenwest.com [50.4.84.125]:36506: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 30 18:20:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.74.68.130
description:
Jan 30 18:21:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.74.68.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.188.18.25
description:
Jan 30 18:21:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.188.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.74.68.130
description:
2025-01-30 18:21:17 dovecot_login authenticator failed for ([103.74.68.130]) [103.74.68.130]:55321: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.247
description:
2025-01-30 18:21:26 dovecot_plain authenticator failed for (static-76-77-25-247.networklubbock.net) [76.77.25.247]:50169: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Jan 30 18:21:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-01-30 18:22:05 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:48586: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Jan 30 18:22:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-01-30 18:22:22 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:53234: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 18:22:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 30 18:21:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-30 18:21:44 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:60533: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.169.93.173
description:
Jan 30 18:21:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.169.93.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.169.93.173
description:
2025-01-30 18:21:54 dovecot_plain authenticator failed for 173.93.169.34.bc.googleusercontent.com (7.26.82.34.bc.googleusercontent.com) [34.169.93.173]:8265: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Jan 30 18:22:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
description:
Jan 30 18:21:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 30 18:21:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-30 18:21:41 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:37570: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-30 18:21:46 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43310: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 30 18:22:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
description:
2025-01-30 18:21:34 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:36430: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 30 18:21:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
description:
2025-01-30 18:22:30 dovecot_login authenticator failed for ([111.61.176.243]) [111.61.176.243]:16574: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.86.4
description:
Jan 30 18:22:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.86.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
description:
2025-01-30 18:22:15 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:33263: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.246.91
description:
2025-01-30 18:22:41 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:47213: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Jan 30 18:23:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.221.36.42
description:
Jan 30 18:22:57 ait sshd[1082165]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.221.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.221.36.42
description:
Jan 30 18:22:57 ait sshd[1082165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.221.36.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-30 18:23:24 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:46716: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-01-30 18:23:20 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:57837: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
description:
Jan 30 18:23:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Jan 30 18:23:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.246.91
description:
Jan 30 18:22:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.246.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
description:
Jan 30 18:22:44 ait sshd[1081923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 30 18:23:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-30 18:23:09 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:12708: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
description:
Jan 30 18:22:44 ait sshd[1081923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.251.76.222
description:
[2025-01-30 18:22:53 +0100] info [webmaild] 41.251.76.222 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.101
description:
Jan 30 18:24:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Jan 30 18:24:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-30 18:23:34 dovecot_plain authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:57150: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Jan 30 18:23:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-30 18:23:45 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:56270: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 30 18:23:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.161.134
description:
2025-01-30 18:24:02 dovecot_login authenticator failed for ([127.0.0.1]) [90.189.161.134]:59502: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 30 18:23:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.179.106
description:
2025-01-30 18:23:37 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:34377: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-01-30 18:23:43 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:41352: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.101
description:
2025-01-30 18:24:14 dovecot_plain authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:51310: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-01-30 18:24:27 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:50033: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-01-30 18:23:33 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:26250: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 30 18:23:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.75.179.106
description:
Jan 30 18:23:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.75.179.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Jan 30 18:23:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
description:
2025-01-30 18:23:59 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:60540: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-01-30 18:23:53 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:44366: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.70.126
description:
2025-01-30 18:23:54 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.70.126]:43308: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.179.185.218
description:
[2025-01-30 18:24:23 +0100] info [webmaild] 212.179.185.218 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 30 18:24:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-30 18:24:45 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:49732: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
description:
Jan 30 18:24:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 30 18:25:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-30 18:25:13 dovecot_login authenticator failed for ([14.97.7.138]) [182.71.173.250]:49786: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-30 18:25:15 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:42726: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
description:
2025-01-30 18:24:51 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:40818: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.47.172.253
description:
Jan 30 18:25:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.47.172.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 30 18:25:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 30 18:25:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.10
description:
Jan 30 18:24:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
description:
2025-01-30 18:25:02 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:50131: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
description:
Jan 30 18:24:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
description:
2025-01-30 18:24:59 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:45774: 535 Incorrect authentication data (set_id=sates2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 30 18:25:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-30 18:25:05 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:59498: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-30 18:24:40 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:42901: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 30 18:24:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.10
description:
2025-01-30 18:24:49 dovecot_login authenticator failed for ([104.241.238.10]) [104.241.238.10]:34276: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-30 18:25:11 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:48826: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-30 18:25:51 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:56146: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 18:26:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 30 18:26:07 ait sshd[1083731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.71.135.251
description:
[2025-01-30 18:26:10 +0100] info [webmaild] 105.71.135.251 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 30 18:25:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 30 18:25:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Jan 30 18:26:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-30 18:25:40 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:37256: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Jan 30 18:26:07 ait sshd[1083731]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-01-30 18:26:14 dovecot_login authenticator failed for ([114.143.224.97]) [182.156.142.238]:23442: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.31.12.187
description:
Jan 30 18:25:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.31.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.31.12.187
description:
2025-01-30 18:25:56 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:56738: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.19.47
description:
47.128.19.47 - - [30/Jan/2025:18:25:57 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22801118 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=118%2C198&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.19.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-30 18:26:59 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:45058: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
description:
2025-01-30 18:27:09 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:35947: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-30 18:26:39 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (gationshed) [94.45.76.149]:36573: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 30 18:26:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.64.191
description:
Jan 30 18:27:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.64.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-30 18:27:14 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:56639: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Jan 30 18:27:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-01-30 18:27:30 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:48957: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 30 18:27:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 30 18:26:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.240.31
description:
[2025-01-30 18:27:31 +0100] info [webmaild] 187.108.240.31 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
description:
Jan 30 18:28:00 ait sshd[1084376]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
description:
Jan 30 18:28:00 ait sshd[1084376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.239.186
description:
Jan 30 18:28:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.239.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.239.186
description:
2025-01-30 18:28:09 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:22475: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 30 18:28:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-30 18:28:22 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:50118: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
description:
Jan 30 18:28:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
description:
2025-01-30 18:28:27 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:59120: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
description:
Jan 30 18:29:24 ait sshd[1084961]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
description:
Jan 30 18:29:24 ait sshd[1084961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Jan 30 18:28:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.120.18.82
description:
[2025-01-30 18:28:59 +0100] info [webmaild] 187.120.18.82 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-01-30 18:28:44 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:51036: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.255.90.55
description:
Jan 30 18:29:26 ait sshd[1084961]: Failed password for invalid user happy from 185.255.90.55 port 40716 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.152.26
description:
2025-01-30 18:29:50 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.152.26]:39190: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.153.114.124
description:
Jan 30 18:29:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.153.114.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.245.90
description:
Jan 30 18:29:39 ait sshd[1085259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.206.245.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.206.245.90
description:
Jan 30 18:29:39 ait sshd[1085259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.206.245.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.153.114.124
description:
2025-01-30 18:29:39 dovecot_login authenticator failed for ([127.0.0.1]) [218.153.114.124]:3267: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.152.26
description:
Jan 30 18:29:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.152.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.209.205
description:
[2025-01-30 18:29:53 +0100] info [webmaild] 170.231.209.205 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.21.125
description:
Jan 30 18:31:04 ait sshd[1085960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.21.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.248.85.213
description:
[2025-01-30 18:31:18 +0100] info [webmaild] 206.248.85.213 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-31.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.84.60
description:
Jan 30 18:30:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.84.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.21.125
description:
Jan 30 18:31:04 ait sshd[1085960]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.21.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 18:30:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.67.196.249
description:
Jan 30 18:30:54 ait sshd[1085800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.67.196.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.67.196.249
description:
Jan 30 18:30:54 ait sshd[1085800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.196.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.29.53
description:
2025-01-30 18:32:29 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:56394: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.121.49.166
description:
[2025-01-30 18:32:16 +0100] info [webmaild] 191.121.49.166 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-30 18:32:15 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:63483: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
description:
Jan 30 18:32:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-30 18:32:12 dovecot_plain authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:64764: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 30 18:32:16 ait sshd[1086316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Jan 30 18:31:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-30 18:32:08 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:60589: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 30 18:32:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
description:
Jan 30 18:32:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.252
description:
2025-01-30 18:32:02 dovecot_login authenticator failed for ([127.0.0.1]) [183.220.241.252]:59670: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.223.168.193
description:
Jan 30 18:32:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.223.168.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Jan 30 18:32:16 ait sshd[1086316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.255.236.213
description:
Jan 30 18:31:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.255.236.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Jan 30 18:31:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-01-30 18:32:00 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:34010: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
description:
Jan 30 18:32:57 ait sshd[1086439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 18:33:08 ait sshd[1086595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 18:33:08 ait sshd[1086595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.237
description:
Jan 30 18:32:57 ait sshd[1086439]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.145.238
description:
2025-01-30 18:34:20 dovecot_login authenticator failed for ([127.0.0.1]) [171.237.145.238]:41131: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
description:
2025-01-30 18:34:30 dovecot_login authenticator failed for ([127.0.0.1]) [175.136.192.106]:59356: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.151.77.222
description:
Jan 30 18:34:11 ait sshd[1087127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.151.77.222


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.151.77.222
description:
Jan 30 18:34:11 ait sshd[1087127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.151.77.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
description:
Jan 30 18:34:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Jan 30 18:34:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.67.59.65
description:
Jan 30 18:33:58 ait sshd[1087015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.67.59.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.249
description:
2025-01-30 18:33:58 dovecot_login authenticator failed for ([104.241.237.249]) [104.241.237.249]:47803: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-30 18:34:16 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:47497: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.249
description:
Jan 30 18:33:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.67.59.65
description:
Jan 30 18:33:58 ait sshd[1087015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.67.59.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.21.125
description:
Jan 30 18:34:07 ait sshd[1087108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.21.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 30 18:34:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.237.145.238
description:
Jan 30 18:34:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.237.145.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.206.245.90
description:
Jan 30 18:34:18 ait sshd[1087168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.206.245.90


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.21.125
description:
Jan 30 18:34:07 ait sshd[1087108]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.21.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 30 18:34:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
description:
2025-01-30 18:34:02 dovecot_plain authenticator failed for (bormachae) [46.163.154.14]:40948: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 30 18:34:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-30 18:34:25 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:62774: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.141.77.172
description:
[2025-01-30 18:33:40 +0100] info [webmaild] 185.141.77.172 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.175.201.58
description:
Jan 30 18:34:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.175.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.245.90
description:
Jan 30 18:34:18 ait sshd[1087168]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.206.245.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.175.201.58
description:
2025-01-30 18:34:21 dovecot_plain authenticator failed for ([59.175.201.58]) [59.175.201.58]:60427: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-30 18:34:32 dovecot_plain authenticator failed for ([218.1.239.146]) [116.231.84.13]:19004: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.179.57.150
description:
Jan 30 18:35:13 ait sshd[1087642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.57.150


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.21.125
description:
Jan 30 18:35:21 ait sshd[1087657]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.21.125 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
description:
Jan 30 18:35:22 ait sshd[1087657]: Failed password for invalid user test from 83.235.21.125 port 52004 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-01-30 18:35:25 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:50253: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Jan 30 18:34:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.89.5.246
description:
2025-01-30 18:35:12 dovecot_login authenticator failed for (0A8yYvMh2a) [102.89.5.246]:62423: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.157.189.89
description:
[2025-01-30 18:34:33 +0100] info [webmaild] 93.157.189.89 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 30 18:35:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.21.125
description:
Jan 30 18:35:21 ait sshd[1087657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.21.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Jan 30 18:35:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-01-30 18:34:43 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:36275: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-30 18:35:02 dovecot_plain authenticator failed for (201-91-196-177.customer.tdatabrasil.net.br) [186.238.43.146]:42366: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.179.57.150
description:
Jan 30 18:35:13 ait sshd[1087642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.179.57.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Jan 30 18:35:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-30 18:35:49 dovecot_plain authenticator failed for ([89.211.42.163]) [37.186.40.110]:38569: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-30 18:35:38 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:35242: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 30 18:35:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.231.64.130
description:
[2025-01-30 18:35:57 +0100] info [webmaild] 177.231.64.130 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.67.196.249
description:
Jan 30 18:35:58 ait sshd[1087931]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.67.196.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.85.163
description:
Jan 30 18:36:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.201.85.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.216.125
description:
Jan 30 18:35:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.216.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.216.125
description:
2025-01-30 18:35:42 dovecot_plain authenticator failed for (nl125-twinpalm-216-lk.zamnet.zm) [196.46.216.125]:38152: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.245.90
description:
Jan 30 18:35:45 ait sshd[1087870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.206.245.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.85.163
description:
2025-01-30 18:36:07 dovecot_plain authenticator failed for ([87.201.85.163]) [87.201.85.163]:49275: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.206.245.90
description:
Jan 30 18:35:45 ait sshd[1087870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.206.245.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 30 18:35:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-30 18:35:51 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:60904: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.67.196.249
description:
Jan 30 18:35:58 ait sshd[1087931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.196.249


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.154.247.53
description:
[2025-01-30 18:36:42 +0100] info [cpaneld] 165.154.247.53 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.67.196.249
description:
Jan 30 18:37:03 ait sshd[1088462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.67.196.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.151.77.222
description:
Jan 30 18:37:01 ait sshd[1088458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.151.77.222


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.151.77.222
description:
Jan 30 18:37:01 ait sshd[1088458]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.151.77.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.179.57.150
description:
Jan 30 18:37:09 ait sshd[1088498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.57.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.188.11.211
description:
[2025-01-30 18:36:43 +0100] info [webmaild] 187.188.11.211 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.67.196.249
description:
Jan 30 18:37:03 ait sshd[1088462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.196.249


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.28.238.182
description:
Jan 30 18:37:06 ait sshd[1088486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.238.182


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.179.57.150
description:
Jan 30 18:37:09 ait sshd[1088498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.179.57.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 18:37:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:37:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
description:
2025-01-30 18:38:19 dovecot_login authenticator failed for (196-250-177-106.teleceliberia.com) [196.250.177.106]:37101: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:37:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Jan 30 18:38:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.224.136
description:
[2025-01-30 18:38:02 +0100] info [webmaild] 181.94.224.136 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-01-30 18:38:02 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:62726: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
description:
Jan 30 18:38:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.78
description:
Jan 30 18:38:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.16.56.211
description:
[2025-01-30 18:38:53 +0100] info [webmaild] 62.16.56.211 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-01-30 18:39:15 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:59535: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.67.59.65
description:
Jan 30 18:38:32 ait sshd[1089063]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.67.59.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.179.57.150
description:
Jan 30 18:38:46 ait sshd[1089262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.57.150


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 30 18:39:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-30 18:38:50 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:35772: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 30 18:38:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
description:
2025-01-30 18:38:37 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:43878: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.209.173.203
description:
2025-01-30 18:39:30 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:58710: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.67.59.65
description:
Jan 30 18:38:32 ait sshd[1089063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.67.59.65


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.28.238.182
description:
Jan 30 18:39:03 ait sshd[1089466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.238.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.209.173.203
description:
Jan 30 18:39:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.209.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.179.57.150
description:
Jan 30 18:38:46 ait sshd[1089262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.179.57.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.151.77.222
description:
Jan 30 18:39:20 ait sshd[1089584]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.151.77.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.151.77.222
description:
Jan 30 18:39:20 ait sshd[1089584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.151.77.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 18:40:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
description:
Jan 30 18:40:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 18:40:29 dovecot_plain authenticator failed for (silersed) [81.211.77.58]:52635: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
description:
2025-01-30 18:40:29 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:49433: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.134.41.229
description:
[2025-01-30 18:40:03 +0100] info [webmaild] 178.134.41.229 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-30 18:40:04 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:18770: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.221.36.42
description:
Jan 30 18:40:23 ait sshd[1090334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.221.36.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 30 18:40:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.221.36.42
description:
Jan 30 18:40:23 ait sshd[1090334]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.221.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:39:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 30 18:40:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.127.86.230
description:
[2025-01-30 18:40:57 +0100] info [webmaild] 103.127.86.230 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Jan 30 18:41:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-30 18:40:32 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:57415: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.110.194
description:
2025-01-30 18:41:18 dovecot_login authenticator failed for host194.sub-63-46-110.myvzw.com [63.46.110.194]:45756: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.67.59.65
description:
Jan 30 18:40:43 ait sshd[1090461]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.67.59.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-01-30 18:41:04 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:52767: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.110.194
description:
Jan 30 18:41:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.110.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.221.36.42
description:
Jan 30 18:41:14 ait sshd[1090752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.221.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 30 18:40:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-30 18:40:38 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:60915: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.67.59.65
description:
Jan 30 18:40:43 ait sshd[1090461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.67.59.65


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.221.36.42
description:
Jan 30 18:41:14 ait sshd[1090752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.221.36.42


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
description:
Jan 30 18:42:21 ait sshd[1091075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.212
description:
Jan 30 18:42:21 ait sshd[1091075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:42:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 30 18:42:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 18:42:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.78.214.170
description:
[2025-01-30 18:42:18 +0100] info [webmaild] 201.78.214.170 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.142.52.210
description:
[2025-01-30 18:43:15 +0100] info [cpaneld] 83.142.52.210 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
description:
Jan 30 18:43:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.238.182
description:
Jan 30 18:42:37 ait sshd[1091157]: Failed password for invalid user ubuntu from 104.28.238.182 port 46166 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
description:
Jan 30 18:42:33 ait sshd[1091079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-30 18:42:33 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:51294: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 30 18:42:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-30 18:42:45 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:37939: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.28.238.182
description:
Jan 30 18:42:34 ait sshd[1091157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.238.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.26.136.12
description:
[2025-01-30 18:42:46 +0100] info [cpaneld] 154.26.136.12 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.141.125.87
description:
[2025-01-30 18:43:08 +0100] info [webmaild] 94.141.125.87 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-30 18:43:30 dovecot_login authenticator failed for ([182.70.120.127]) [182.70.120.127]:49530: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 30 18:43:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-43.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-30 18:43:41 dovecot_login authenticator failed for ([58.216.101.162]) [58.216.101.162]:52463: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.128.155.43
description:
[2025-01-30 18:44:19 +0100] info [webmaild] 94.128.155.43 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.83.38.15
description:
2025-01-30 18:45:25 dovecot_login authenticator failed for (50-83-38-15.client.mchsi.com) [50.83.38.15]:36830: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
description:
Jan 30 18:45:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
description:
2025-01-30 18:45:16 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:11691: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 30 18:45:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-30 18:45:27 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:19425: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.83.38.15
description:
Jan 30 18:45:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.83.38.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 18:45:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.55.161.108
description:
[2025-01-30 18:45:12 +0100] info [webmaild] 37.55.161.108 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.58.49.145
description:
2025-01-30 18:45:34 dovecot_plain authenticator failed for ([211.58.49.145]) [211.58.49.145]:48442: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Jan 30 18:45:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.66.200
description:
2025-01-30 18:45:35 dovecot_login authenticator failed for ([120.82.66.200]) [120.82.66.200]:60903: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-01-30 18:45:37 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:50223: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.112.186
description:
Jan 30 18:45:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.112.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
description:
2025-01-30 18:45:54 dovecot_plain authenticator failed for ([187.12.112.186]) [187.12.112.186]:47468: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.138.162
description:
Jan 30 18:46:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.148.249
description:
Jan 30 18:46:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.148.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.138.162
description:
2025-01-30 18:46:04 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:50930: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.58.49.145
description:
Jan 30 18:45:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.58.49.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.66.200
description:
Jan 30 18:45:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.66.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.148.249
description:
2025-01-30 18:46:06 dovecot_plain authenticator failed for ([120.71.148.249]) [120.71.148.249]:44852: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.39.3.234
description:
[2025-01-30 18:47:25 +0100] info [webmaild] 102.39.3.234 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.98.109.172
description:
[2025-01-30 18:46:37 +0100] info [webmaild] 85.98.109.172 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 30 18:47:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-30 18:47:19 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:46799: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-47.104.209.253.237


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.254.209.129
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:18-47.103.254.209.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
description:
2025-01-30 18:47:43 dovecot_plain authenticator failed for ([58.18.89.146]) [58.18.89.146]:53452: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.89.146
description:
Jan 30 18:47:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.89.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.132.116
description:
[2025-01-30 18:48:44 +0100] info [webmaild] 41.56.132.116 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.107.67.110
description:
[2025-01-30 18:49:36 +0100] info [webmaild] 86.107.67.110 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-01-30 18:49:47 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:53178: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 18:50:05 ait sshd[1094580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 18:50:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 30 18:50:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.163.175
description:
Jan 30 18:50:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.161.163.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 30 18:49:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-30 18:49:35 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:56510: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Jan 30 18:49:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 30 18:50:05 ait sshd[1094580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-30 18:50:26 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:38128: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.161.163.175
description:
2025-01-30 18:50:28 dovecot_login authenticator failed for ([127.0.0.1]) [113.161.163.175]:43027: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.83.226.230
description:
[2025-01-30 18:51:32 +0100] info [webmaild] 41.83.226.230 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
description:
Jan 30 18:50:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
description:
2025-01-30 18:50:40 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:42594: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
description:
2025-01-30 18:50:53 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:34094: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.23.108
description:
[2025-01-30 18:50:39 +0100] info [webmaild] 179.6.23.108 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 18:51:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.72.131
description:
Jan 30 18:50:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.72.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Jan 30 18:50:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-01-30 18:51:01 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:38116: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 18:51:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.72.131
description:
2025-01-30 18:50:36 dovecot_login authenticator failed for ([127.0.0.1]) [178.66.72.131]:44347: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.170.36
description:
[2025-01-30 18:50:43 +0100] info [webmaild] 177.11.170.36 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Jan 30 18:50:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
description:
Jan 30 18:52:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-01-30 18:52:17 dovecot_plain authenticator failed for (85.105.241.188.static.ttnet.com.tr) [85.105.241.188]:51494: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.166
description:
Jan 30 18:52:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.166
description:
2025-01-30 18:52:10 dovecot_plain authenticator failed for ([218.149.228.166]) [218.149.228.166]:50728: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.42.57.97
description:
2025-01-30 18:52:34 dovecot_plain authenticator failed for (ait.edu.gh) [110.42.57.97]:59620: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.72.84
description:
[2025-01-30 18:53:03 +0100] info [webmaild] 177.223.72.84 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Jan 30 18:54:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-01-30 18:54:21 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:53818: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.225.148.189
description:
[2025-01-30 18:53:56 +0100] info [webmaild] 41.225.148.189 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 30 18:54:38 ait sshd[1096252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-30 18:54:38 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:55026: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.231.160
description:
[2025-01-30 18:54:41 +0100] info [webmaild] 45.65.231.160 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-01-30 18:55:07 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:54700: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 30 18:55:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 30 18:54:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 30 18:54:38 ait sshd[1096252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Jan 30 18:55:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-30 18:55:22 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:4615: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-30 18:56:08 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:64546: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.191.151
description:
[2025-01-30 18:55:33 +0100] info [webmaild] 167.250.191.151 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-55.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
description:
Jan 30 18:55:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-01-30 18:55:54 dovecot_login authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:50918: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 30 18:56:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.75.179.106
description:
Jan 30 18:56:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.75.179.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.149.200.103
description:
[2025-01-30 18:57:04 +0100] info [webmaild] 200.149.200.103 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 18:57:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.48
description:
Jan 30 18:57:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.25.73
description:
Jan 30 18:57:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.25.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.213.66
description:
Jan 30 18:57:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.213.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.25.73
description:
2025-01-30 18:57:40 dovecot_plain authenticator failed for ([31.173.25.73]) [31.173.25.73]:54128: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Jan 30 18:57:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-01-30 18:57:59 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:44011: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.16.240
description:
[2025-01-30 18:58:07 +0100] info [webmaild] 177.12.16.240 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 30 18:58:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Jan 30 18:58:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.150.37.249
description:
Jan 30 18:58:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.150.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.150.37.249
description:
2025-01-30 18:59:01 dovecot_plain authenticator failed for ([217.150.37.249]) [217.150.37.249]:59976: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.126.189.195
description:
[2025-01-30 18:59:02 +0100] info [webmaild] 189.126.189.195 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-01-30 18:58:33 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:44468: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 18:58:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
description:
Jan 30 18:58:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 30 18:59:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
description:
2025-01-30 18:58:42 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:33291: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-30 18:59:10 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:40024: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 18:59:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-30 18:59:59 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:35018: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-01-30 19:00:01 dovecot_login authenticator failed for ([127.0.0.1]) [180.168.111.34]:37979: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 18:59:46 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:57395: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 30 18:59:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.146
description:
Jan 30 18:59:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Jan 30 18:59:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.66.222
description:
Jan 30 18:59:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 30 18:59:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 30 19:00:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.65.234.178
description:
[2025-01-30 18:59:41 +0100] info [webmaild] 196.65.234.178 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 30 18:59:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 18:59:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-30 19:00:14 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:36754: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 19:01:04 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:3878: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.176.148
description:
[2025-01-30 19:01:12 +0100] info [webmaild] 177.85.176.148 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
description:
2025-01-30 19:01:24 dovecot_plain authenticator failed for ([110.38.70.172]) [110.38.70.172]:21754: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 30 19:00:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-30 19:00:48 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:59619: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
description:
Jan 30 19:01:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-01-30 19:01:22 dovecot_login authenticator failed for (host-115-208-static-98-201.uninet-ide.com.mx) [201.98.208.115]:35208: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Jan 30 19:01:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-01-30 19:01:33 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:53219: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 30 19:01:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Jan 30 19:01:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-30 19:01:37 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:8271: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
description:
2025-01-30 19:01:59 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:52932: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.122
description:
Jan 30 19:02:09 ait sshd[1100007]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.99.54
description:
Jan 30 19:02:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 30 19:01:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
description:
Jan 30 19:01:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-30 19:02:07 dovecot_login authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:49732: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.122
description:
Jan 30 19:02:09 ait sshd[1100007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-01-30 19:02:22 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:38706: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.199.99.54
description:
2025-01-30 19:02:22 dovecot_login authenticator failed for (1224312.cloudwaysapps.com) [24.199.99.54]:27110: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 30 19:02:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 19:01:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.62
description:
2025-01-30 19:01:49 dovecot_login authenticator failed for ([104.241.234.62]) [104.241.234.62]:45388: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.150.71.142
description:
[2025-01-30 19:02:05 +0100] info [webmaild] 91.150.71.142 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-30 19:02:32 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:37010: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.62
description:
Jan 30 19:01:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 30 19:02:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Jan 30 19:02:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 30 19:03:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-30 19:03:17 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:37250: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-01-30 19:03:30 dovecot_plain authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:59072: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.251.57.157
description:
Jan 30 19:02:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.251.57.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.57.157
description:
2025-01-30 19:02:51 dovecot_login authenticator failed for (157.57.251.198.in-addr.arpa) [198.251.57.157]:38542: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 141.98.141.55
description:
[2025-01-30 19:02:52 +0100] info [webmaild] 141.98.141.55 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Jan 30 19:02:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-30 19:02:59 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:10838: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 19:03:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 30 19:02:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-30 19:03:03 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:48623: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-30 19:03:14 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:60406: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.64
description:
2025-01-30 19:03:20 dovecot_plain authenticator failed for ([5.30.225.64]) [5.30.225.64]:35059: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-01-30 19:02:59 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:41471: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 30 19:03:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 30 19:03:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.64
description:
Jan 30 19:03:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Jan 30 19:03:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
description:
2025-01-30 19:03:52 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:50016: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.143
description:
2025-01-30 19:03:55 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.143]:8663: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.239.42
description:
[2025-01-30 19:03:43 +0100] info [webmaild] 45.180.239.42 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.143
description:
Jan 30 19:03:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-01-30 19:03:39 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:41326: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Jan 30 19:03:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 30 19:04:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-30 19:04:31 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:39285: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Jan 30 19:03:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.31.39.66
description:
Jan 30 19:04:05 ait sshd[1100924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.39.66  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-30 19:04:22 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2805: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 30 19:04:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.31.39.66
description:
Jan 30 19:04:05 ait sshd[1100924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.31.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.8.150
description:
2025-01-30 19:04:44 dovecot_login authenticator failed for ([190.61.8.150]) [190.61.8.150]:49358: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-30 19:05:06 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:9284: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 30 19:05:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.143.14.7
description:
2025-01-30 19:05:08 dovecot_login authenticator failed for ([127.0.0.1]) [117.143.14.7]:50434: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.123.128.195
description:
2025-01-30 19:05:18 dovecot_login authenticator failed for ([127.0.0.1]) [175.123.128.195]:34538: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-30 19:05:22 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:35142: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.188.165.198
description:
2025-01-30 19:04:52 dovecot_login authenticator failed for ([202.188.165.198]) [202.188.165.198]:50829: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.123.208.246
description:
Jan 30 19:05:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.123.208.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 30 19:05:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
description:
2025-01-30 19:05:10 dovecot_login authenticator failed for ([124.67.121.58]) [124.67.121.58]:39953: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.31
description:
[2025-01-30 19:05:13 +0100] info [webmaild] 213.230.93.31 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Jan 30 19:05:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.61.8.150
description:
Jan 30 19:04:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.61.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-01-30 19:05:10 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:42702: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.57.70.22
description:
Jan 30 19:05:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.57.70.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-30 19:05:25 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:54536: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-30 19:05:28 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:41030: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 30 19:04:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-30 19:04:37 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:56012: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.67.121.58
description:
Jan 30 19:05:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.67.121.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-01-30 19:05:18 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:45742: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 30 19:05:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.143.14.7
description:
Jan 30 19:05:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.143.14.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.57.70.22
description:
2025-01-30 19:05:18 dovecot_login authenticator failed for (host-216-57-70-22-cal.net) [216.57.70.22]:55331: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.188.165.198
description:
Jan 30 19:04:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.188.165.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.123.208.246
description:
2025-01-30 19:05:03 dovecot_login authenticator failed for 246.208.123.34.bc.googleusercontent.com [34.123.208.246]:53102: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 30 19:05:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.123.128.195
description:
Jan 30 19:05:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.123.128.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 30 19:05:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.57.33.221
description:
Jan 30 19:05:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.57.33.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
description:
2025-01-30 19:05:52 dovecot_login authenticator failed for ([127.0.0.1]) [120.57.33.221]:40202: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Jan 30 19:06:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-01-30 19:06:24 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:38294: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.216.135.13
description:
2025-01-30 19:05:41 dovecot_login authenticator failed for ([127.0.0.1]) [103.216.135.13]:52234: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-30 19:05:45 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:42370: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 30 19:05:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 19:05:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.122
description:
Jan 30 19:06:01 ait sshd[1101971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.122


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.10.124
description:
Jan 30 19:06:29 ait sshd[1102167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.10.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 30 19:05:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.122
description:
Jan 30 19:06:01 ait sshd[1101971]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.113.88
description:
[2025-01-30 19:06:07 +0100] info [webmaild] 170.79.113.88 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.13
description:
Jan 30 19:05:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.158.18.129
description:
Jan 30 19:06:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.158.18.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.10.124
description:
Jan 30 19:06:29 ait sshd[1102167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.10.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.246.138.100
description:
Jan 30 19:07:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.246.138.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
description:
Jan 30 19:06:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.10.124
description:
Jan 30 19:06:31 ait sshd[1102167]: Failed password for invalid user test from 54.37.10.124 port 53164 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-30 19:06:45 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:37055: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.65.227
description:
Jan 30 19:06:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.65.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.100.208.56
description:
2025-01-30 19:06:54 dovecot_login authenticator failed for 79-100-208-56.ip.btc-net.bg (31094-49731.bacloud.info.) [79.100.208.56]:3777: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-30 19:06:56 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:51004: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
description:
2025-01-30 19:06:34 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:35292: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 30 19:06:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.208.56
description:
Jan 30 19:06:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.208.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 19:06:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.53.243
description:
[2025-01-30 19:07:13 +0100] info [webmaild] 191.242.53.243 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 30 19:07:20 ait sshd[1102304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.229.19.137
description:
Jan 30 19:06:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.229.19.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.229.19.137
description:
2025-01-30 19:06:36 dovecot_plain authenticator failed for ([45.229.19.137]) [45.229.19.137]:55016: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 30 19:06:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.65.227
description:
2025-01-30 19:06:53 dovecot_login authenticator failed for ([121.147.65.227]) [121.147.65.227]:57588: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 30 19:07:20 ait sshd[1102304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-30 19:06:40 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:40844: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 30 19:06:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.138.100
description:
2025-01-30 19:07:09 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:37526: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.122
description:
Jan 30 19:07:25 ait sshd[1102315]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.122
description:
Jan 30 19:07:25 ait sshd[1102315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.122  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.152
description:
2025-01-30 19:08:04 dovecot_login authenticator failed for ([104.241.233.152]) [104.241.233.152]:43362: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.239.246.153
description:
2025-01-30 19:08:09 dovecot_login authenticator failed for 213-239-246-153.clients.your-server.de ([127.0.0.1]) [213.239.246.153]:35548: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Jan 30 19:08:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Jan 30 19:08:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-08.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.152
description:
Jan 30 19:08:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-01-30 19:08:03 dovecot_plain authenticator failed for ([39.165.236.12]) [39.165.236.12]:54384: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
description:
2025-01-30 19:08:03 dovecot_login authenticator failed for ([127.0.0.1]) [222.114.84.175]:33114: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-30 19:08:08 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:45359: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
description:
Jan 30 19:08:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
description:
Jan 30 19:08:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 30 19:07:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.71.106
description:
Jan 30 19:08:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-01-30 19:08:18 dovecot_login authenticator failed for ([160.72.153.14]) [160.72.153.14]:46691: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.31.39.66
description:
Jan 30 19:07:59 ait sshd[1102616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.39.66


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.71.168.146
description:
[2025-01-30 19:08:05 +0100] info [webmaild] 189.71.168.146 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.239.246.153
description:
Jan 30 19:08:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.239.246.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.172.131
description:
Jan 30 19:07:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.172.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
description:
2025-01-30 19:07:45 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:33282: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.31.39.66
description:
Jan 30 19:07:59 ait sshd[1102616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.31.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
description:
Jan 30 19:08:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 30 19:08:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
description:
2025-01-30 19:08:16 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:43055: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.71.106
description:
2025-01-30 19:08:28 dovecot_plain authenticator failed for (abts-kk-static-106.71.166.122.airtelbroadband.in) [122.166.71.106]:37585: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 19:07:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.80.201
description:
2025-01-30 19:07:50 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:59933: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 19:09:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 30 19:10:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.31.39.66
description:
Jan 30 19:09:44 ait sshd[1103509]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.31.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.213.126
description:
2025-01-30 19:10:05 dovecot_login authenticator failed for ([127.0.0.1]) [5.30.213.126]:58681: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-30 19:10:18 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:38510: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
description:
2025-01-30 19:10:22 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:41730: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 30 19:10:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.213.126
description:
Jan 30 19:10:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.213.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.125.64.126
description:
Jan 30 19:10:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.125.64.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.125.64.126
description:
2025-01-30 19:10:26 dovecot_login authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:53246: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.31.39.66
description:
Jan 30 19:09:44 ait sshd[1103509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.39.66


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.42.134
description:
[2025-01-30 19:10:11 +0100] info [webmaild] 191.99.42.134 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
description:
Jan 30 19:10:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-30 19:10:30 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com (holish) [131.106.85.205]:40764: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-01-30 19:10:39 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:49032: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.180.46.58
description:
Jan 30 19:10:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.180.46.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.5.195
description:
[2025-01-30 19:11:28 +0100] info [webmaild] 177.36.5.195 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 30 19:10:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.10.124
description:
Jan 30 19:10:36 ait sshd[1104024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.10.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-30 19:10:37 dovecot_login authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:35836: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 30 19:10:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-30 19:10:51 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:50190: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.28.192
description:
47.128.28.192 - - [30/Jan/2025:19:10:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7251564 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?filter_course-language=121&filtering=1&level=all_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.28.192


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.160.247.200
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-11.5.160.247.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.210.105.166
description:
Jan 30 19:10:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.210.105.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.175.109.130
description:
2025-01-30 19:10:33 dovecot_login authenticator failed for ([127.0.0.1]) [14.175.109.130]:41610: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.166
description:
2025-01-30 19:10:34 dovecot_login authenticator failed for 95-210-105-166.ip.skylogicnet.com [95.210.105.166]:58114: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Jan 30 19:10:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.180.46.58
description:
2025-01-30 19:10:43 dovecot_login authenticator failed for ([127.0.0.1]) [113.180.46.58]:57610: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.40.194
description:
Jan 30 19:10:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.248.40.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.40.194
description:
2025-01-30 19:10:59 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:37078: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.10.124
description:
Jan 30 19:10:36 ait sshd[1104024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.10.124 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.10.124
description:
Jan 30 19:11:46 ait sshd[1104439]: Failed password for invalid user test1 from 54.37.10.124 port 36652 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 30 19:12:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 30 19:11:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-30 19:11:49 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:31899: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.2.202
description:
Jan 30 19:11:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
description:
Jan 30 19:11:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.10.124
description:
Jan 30 19:11:44 ait sshd[1104439]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.10.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
description:
2025-01-30 19:12:01 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:38478: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Jan 30 19:12:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 30 19:12:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-01-30 19:12:21 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:44202: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-30 19:12:24 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:33710: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.10.124
description:
Jan 30 19:11:44 ait sshd[1104439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.10.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-30 19:12:22 dovecot_plain authenticator failed for ([91.234.132.226]) [91.234.132.226]:50200: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.159.21.207
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:eng09b99891@ait.edu.gh||WPU:eng09b99891@ait.edu.gh||RSV:6.65||T:APACHE||MV:19-11.45.159.21.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-30 19:11:39 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:60871: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.2.202
description:
2025-01-30 19:11:53 dovecot_login authenticator failed for ([221.224.2.202]) [221.224.2.202]:56955: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.40.221.254
description:
[2025-01-30 19:12:21 +0100] info [webmaild] 187.40.221.254 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 30 19:11:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.104
description:
Jan 30 19:11:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-01-30 19:12:05 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:57166: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Jan 30 19:12:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.167.200.10
description:
Jan 30 19:12:36 ait sshd[1104823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.167.200.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 30 19:13:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-30 19:12:37 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:1903: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 30 19:12:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.111.127
description:
2025-01-30 19:12:45 dovecot_plain authenticator failed for ([212.90.111.127]) [212.90.111.127]:48595: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-01-30 19:13:14 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:33719: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-01-30 19:13:24 dovecot_plain authenticator failed for ([148.72.244.39]) [148.72.244.39]:57848: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.111.127
description:
Jan 30 19:12:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.111.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 30 19:12:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-30 19:12:42 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:58091: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Jan 30 19:13:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 19:13:25 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:60852: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.85.109
description:
[2025-01-30 19:13:18 +0100] info [webmaild] 45.165.85.109 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.200.10
description:
Jan 30 19:12:36 ait sshd[1104823]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.167.200.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Jan 30 19:13:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 8.242.220.26
description:
[2025-01-30 19:14:12 +0100] info [webmaild] 8.242.220.26 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.73.86
description:
2025-01-30 19:13:37 dovecot_login authenticator failed for ([127.0.0.1]) [95.52.73.86]:60990: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.145.80
description:
Jan 30 19:13:58 ait sshd[1105191]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.145.145.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.145.145.80
description:
Jan 30 19:13:58 ait sshd[1105191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.145.145.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.73.86
description:
Jan 30 19:13:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.73.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 30 19:13:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-30 19:13:45 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:34318: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 30 19:15:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.66.136.6
description:
Jan 30 19:15:29 ait sshd[1105882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.66.136.6


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.167.200.10
description:
Jan 30 19:14:57 ait sshd[1105679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.167.200.10


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.200.10
description:
Jan 30 19:14:57 ait sshd[1105679]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.167.200.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-30 19:15:19 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:43284: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.167.200.10
description:
Jan 30 19:16:05 ait sshd[1106225]: Failed password for invalid user sammy from 109.167.200.10 port 47616 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.145.80
description:
Jan 30 19:15:53 ait sshd[1106122]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.145.145.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.96.77
description:
[2025-01-30 19:15:53 +0100] info [webmaild] 45.170.96.77 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.10.94
description:
2025-01-30 19:15:37 dovecot_login authenticator failed for ([223.71.10.94]) [223.71.10.94]:27520: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.66.136.6
description:
Jan 30 19:16:23 ait sshd[1106351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.66.136.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.10.94
description:
Jan 30 19:15:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.10.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.167.200.10
description:
Jan 30 19:16:04 ait sshd[1106225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.167.200.10


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.200.10
description:
Jan 30 19:16:04 ait sshd[1106225]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.167.200.10 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.66.136.6
description:
Jan 30 19:15:32 ait sshd[1105882]: Disconnected from invalid user test 183.66.136.6 port 34310 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.145.145.80
description:
Jan 30 19:15:53 ait sshd[1106122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.145.145.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.145.145.80
description:
Jan 30 19:17:13 ait sshd[1106681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.145.145.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-30 19:17:26 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:36576: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-30 19:17:25 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:52384: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.120.240.202
description:
Jan 30 19:17:31 ait sshd[1106743]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.120.240.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.120.240.202
description:
Jan 30 19:17:31 ait sshd[1106743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.120.240.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 30 19:17:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 30 19:17:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.214.100.243
description:
[2025-01-30 19:16:44 +0100] info [webmaild] 186.214.100.243 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.66.136.6
description:
Jan 30 19:16:55 ait sshd[1106591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.66.136.6


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.145.80
description:
Jan 30 19:17:13 ait sshd[1106681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.145.145.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.76.202.22
description:
Jan 30 19:17:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.76.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.168.226
description:
Jan 30 19:18:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 30 19:17:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 30 19:18:04 ait sshd[1107046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.207
description:
Jan 30 19:18:04 ait sshd[1107026]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.207
description:
Jan 30 19:18:04 ait sshd[1107026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.191.71.148
description:
Jan 30 19:18:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.191.71.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.247.97.213
description:
[2025-01-30 19:18:32 +0100] info [webmaild] 177.247.97.213 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.150.243
description:
[2025-01-30 19:17:35 +0100] info [webmaild] 45.70.150.243 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-30 19:17:47 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:56194: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.202.22
description:
2025-01-30 19:17:47 dovecot_login authenticator failed for ([218.76.202.22]) [218.76.202.22]:55767: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.191.71.148
description:
2025-01-30 19:18:10 dovecot_login authenticator failed for ([127.0.0.1]) [113.191.71.148]:35542: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
description:
2025-01-30 19:18:20 dovecot_login authenticator failed for ([127.0.0.1]) [200.216.168.226]:60287: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.120.240.202
description:
Jan 30 19:17:33 ait sshd[1106743]: Failed password for invalid user debian from 93.120.240.202 port 47192 ssh2


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.207
description:
Jan 30 19:18:27 ait sshd[1107026]: error: maximum authentication attempts exceeded for root from 218.92.0.207 port 42188 ssh2 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 30 19:18:04 ait sshd[1107046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 30 19:18:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.152.26
description:
Jan 30 19:19:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.152.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.187.106.53
description:
2025-01-30 19:19:17 dovecot_login authenticator failed for ([127.0.0.1]) [113.187.106.53]:41921: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 30 19:18:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.187.106.53
description:
Jan 30 19:19:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.187.106.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.152.26
description:
2025-01-30 19:19:08 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.152.26]:41983: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
description:
2025-01-30 19:18:47 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:31394: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-30 19:18:58 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:60363: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-20.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 30 19:20:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-30 19:20:29 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (aliattes) [92.244.126.105]:54867: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 19:19:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.163.130.18
description:
[2025-01-30 19:19:55 +0100] info [webmaild] 109.163.130.18 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:19-21.104.209.253.237


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.52.30.74
description:
[2025-01-30 19:20:45 +0100] info [webmaild] 177.52.30.74 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.183
description:
Jan 30 19:20:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 30 19:21:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 30 19:21:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 30 19:20:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-30 19:20:38 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:57002: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.104.127.183
description:
2025-01-30 19:20:50 dovecot_login authenticator failed for ([103.104.127.183]) [103.104.127.183]:2783: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-30 19:22:05 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:60421: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 30 19:22:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 30 19:21:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 30 19:22:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 30 19:22:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-30 19:22:06 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:45658: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 30 19:22:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 30 19:22:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-01-30 19:21:34 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:40224: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Jan 30 19:21:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-30 19:21:50 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:29164: 535 Incorrect authentication data (set_id=ads67a66609y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-30 19:22:10 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:57266: 535 Incorrect authentication data (set_id=ads67a66609y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-30 19:22:19 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:56248: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-30 19:22:27 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:56836: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.97.213
description:
[2025-01-30 19:21:38 +0100] info [webmaild] 170.150.97.213 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-01-30 19:21:45 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:50894: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 30 19:21:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-30 19:22:17 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:49478: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.37.14
description:
[2025-01-30 19:22:31 +0100] info [webmaild] 191.7.37.14 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-30 19:21:34 dovecot_plain authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:50466: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-30 19:21:43 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:59620: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 30 19:22:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
description:
Jan 30 19:23:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
description:
2025-01-30 19:23:21 dovecot_login authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:49908: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 30 19:23:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 30 19:22:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-30 19:22:57 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:11580: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 19:24:08 ait sshd[1110012]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.120.240.202
description:
Jan 30 19:24:15 ait sshd[1110057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.120.240.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Jan 30 19:23:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-01-30 19:23:57 dovecot_login authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:43439: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 30 19:24:07 ait sshd[1110012]: Invalid user universitypublishing from 175.126.195.176 port 47920


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.120.240.202
description:
Jan 30 19:24:15 ait sshd[1110057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.120.240.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Jan 30 19:23:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 19:24:08 ait sshd[1110012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-01-30 19:23:50 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:19898: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.24.68
description:
2025-01-30 19:24:11 dovecot_login authenticator failed for syn-173-095-024-068.biz.spectrum.com [173.95.24.68]:1253: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-30 19:23:35 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:49323: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
description:
2025-01-30 19:23:36 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:53214: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 19:24:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.86.4
description:
Jan 30 19:23:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.86.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.24.68
description:
Jan 30 19:24:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.24.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.14.118.36
description:
[2025-01-30 19:24:09 +0100] info [webmaild] 95.14.118.36 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-30 19:25:31 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:36366: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-30 19:24:38 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:37552: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 30 19:25:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 30 19:24:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.132.117.15
description:
[2025-01-30 19:25:03 +0100] info [webmaild] 85.132.117.15 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Jan 30 19:25:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-30 19:25:26 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:40456: 535 Incorrect authentication data (set_id=ads21b11212y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 30 19:24:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.254.93.70
description:
Jan 30 19:24:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.254.93.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-01-30 19:25:06 dovecot_plain authenticator failed for ([195.222.57.182]) [195.222.57.190]:37368: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.24.68
description:
2025-01-30 19:25:12 dovecot_login authenticator failed for syn-173-095-024-068.biz.spectrum.com [173.95.24.68]:2722: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 30 19:25:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Jan 30 19:24:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-30 19:24:57 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:57326: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.24.68
description:
Jan 30 19:25:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.24.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-01-30 19:24:46 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:44936: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.254.93.70
description:
2025-01-30 19:24:55 dovecot_plain authenticator failed for ([61.254.93.70]) [61.254.93.70]:39666: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.244.192
description:
[2025-01-30 19:25:51 +0100] info [webmaild] 201.49.244.192 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.233.94.128
description:
Jan 30 19:25:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.233.94.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-30 19:25:43 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:47976: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 19:25:43 ait sshd[1110804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.26
description:
2025-01-30 19:25:58 dovecot_login authenticator failed for ([104.241.233.26]) [104.241.233.26]:56941: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.233.94.128
description:
2025-01-30 19:25:36 dovecot_login authenticator failed for (ait.edu.gh) [178.233.94.128]:17660: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.26
description:
Jan 30 19:25:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 30 19:26:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.120.240.202
description:
Jan 30 19:26:29 ait sshd[1111132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.120.240.202


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.120.240.202
description:
Jan 30 19:26:29 ait sshd[1111132]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.120.240.202 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.120.240.202
description:
Jan 30 19:26:31 ait sshd[1111132]: Failed password for invalid user server from 93.120.240.202 port 56558 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 30 19:25:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 19:25:43 ait sshd[1110804]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-30 19:26:26 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:57608: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 30 19:26:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
description:
2025-01-30 19:27:29 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:54182: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-01-30 19:27:30 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:56934: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Jan 30 19:27:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 30 19:26:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.55.152.70
description:
[2025-01-30 19:26:44 +0100] info [webmaild] 189.55.152.70 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
description:
Jan 30 19:27:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-30 19:26:38 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:55842: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.83.22
description:
2025-01-30 19:27:49 dovecot_plain authenticator failed for (2-54-83-22.orange.net.il) [2.54.83.22]:37550: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 30 19:27:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 30 19:27:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-30 19:27:59 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:22882: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.127
description:
2025-01-30 19:28:00 dovecot_login authenticator failed for ([104.241.238.127]) [104.241.238.127]:36790: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-30 19:28:04 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:43383: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-01-30 19:27:45 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:42765: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.127
description:
Jan 30 19:27:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-30 19:28:16 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:50772: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.21.132.98
description:
[2025-01-30 19:28:19 +0100] info [webmaild] 5.21.132.98 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 30 19:28:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-01-30 19:27:41 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:52302: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Jan 30 19:27:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.195.104
description:
Jan 30 19:28:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 30 19:28:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 30 19:27:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-30 19:27:47 dovecot_plain authenticator failed for ([37.57.69.227]) [37.57.69.227]:60027: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-30 19:27:52 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:43917: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 30 19:28:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.195.104
description:
2025-01-30 19:28:02 dovecot_login authenticator failed for ([103.187.195.104]) [103.187.195.104]:48191: 535 Incorrect authentication data (set_id=eng51a11118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 30 19:28:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-30 19:28:31 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (pidealic) [109.164.246.53]:42842: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Jan 30 19:27:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.83.22
description:
Jan 30 19:27:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.83.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.178.21.162
description:
Jan 30 19:29:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.178.21.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
description:
Jan 30 19:29:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.24.68
description:
Jan 30 19:29:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.24.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.189.102.130
description:
[2025-01-30 19:29:12 +0100] info [webmaild] 181.189.102.130 - news@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
description:
2025-01-30 19:28:57 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:23097: 535 Incorrect authentication data (set_id=abs61a11144y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-30 19:28:58 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:30580: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.43.30.3
description:
Jan 30 19:29:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.43.30.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.26.98
description:
Jan 30 19:28:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.26.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
description:
2025-01-30 19:28:34 dovecot_login authenticator failed for ([183.249.1.82]) [183.249.1.82]:53106: 535 Incorrect authentication data (set_id=eng51a11118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.30.3
description:
2025-01-30 19:29:04 dovecot_login authenticator failed for ([118.43.30.3]) [118.43.30.3]:52013: 535 Incorrect authentication data (set_id=ads61b11486y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.24.68
description:
2025-01-30 19:29:28 dovecot_login authenticator failed for syn-173-095-024-068.biz.spectrum.com [173.95.24.68]:2304: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
description:
Jan 30 19:28:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 30 19:28:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-01-30 19:29:00 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:53750: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.178.21.162
description:
2025-01-30 19:29:17 dovecot_login authenticator failed for ([123.178.21.162]) [123.178.21.162]:55490: 535 Incorrect authentication data (set_id=ads61b11486y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
description:
2025-01-30 19:29:21 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-30 19:28:32 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:30062: 535 Incorrect authentication data (set_id=abs61a11144y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-30 19:29:42 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:35370: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-30 19:30:02 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:53729: 535 Incorrect authentication data (set_id=abs68a66678y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.233.88.153
description:
Jan 30 19:30:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.233.88.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.233.88.153
description:
2025-01-30 19:30:30 dovecot_login authenticator failed for (ait.edu.gh) [213.233.88.153]:44086: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 30 19:29:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 30 19:30:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Jan 30 19:30:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 19:30:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-01-30 19:30:20 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:38709: 535 Incorrect authentication data (set_id=abs68a66678y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-30 19:31:28 dovecot_plain authenticator failed for (201-91-196-177.customer.tdatabrasil.net.br) [186.238.43.146]:48413: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 37.97.228.222
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:19-31.37.97.228.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.158.10.60
description:
Jan 30 19:31:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.158.10.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 30 19:31:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
description:
Jan 30 19:31:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
description:
2025-01-30 19:31:13 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:35974: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Jan 30 19:31:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 30 19:31:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
description:
Jan 30 19:30:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
description:
2025-01-30 19:30:47 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (aceloper) [78.68.37.25]:39843: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-30 19:31:27 dovecot_login authenticator failed for ([149.0.16.4]) [149.0.16.4]:52170: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 141.98.141.208
description:
[2025-01-30 19:31:29 +0100] info [webmaild] 141.98.141.208 - news@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.92.22
description:
[2025-01-30 19:30:34 +0100] info [webmaild] 213.230.92.22 - news@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.10.60
description:
2025-01-30 19:31:06 dovecot_login authenticator failed for (95.158.10.60.bestsolution.net.ua) [95.158.10.60]:43041: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-01-30 19:31:26 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:39242: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
description:
Jan 30 19:31:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-01-30 19:31:09 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:37756: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-30 19:32:08 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:22807: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.43.30.3
description:
Jan 30 19:32:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.43.30.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 30 19:31:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 30 19:32:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.51
description:
2025-01-30 19:31:48 dovecot_plain authenticator failed for 111-70-32-51.emome-ip.hinet.net [111.70.32.51]:51845: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.201.163.179
description:
Jan 30 19:32:04 ait sshd[1113984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.201.163.179 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.201.163.179
description:
Jan 30 19:32:04 ait sshd[1113984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.201.163.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.30.3
description:
2025-01-30 19:32:27 dovecot_login authenticator failed for ([118.43.30.3]) [118.43.30.3]:54322: 535 Incorrect authentication data (set_id=ads76a66666y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.188.18.25
description:
Jan 30 19:32:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.188.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.51
description:
Jan 30 19:31:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-30 19:31:54 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:41358: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-01-30 19:32:54 dovecot_login authenticator failed for ([222.106.198.35]) [222.106.198.35]:36114: 535 Incorrect authentication data (set_id=eng21a11118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
description:
2025-01-30 19:33:19 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:35052: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-30 19:32:34 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:51508: 535 Incorrect authentication data (set_id=abs44a22224y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Jan 30 19:32:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-01-30 19:32:45 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:40600: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 30 19:32:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
description:
2025-01-30 19:32:34 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:56126: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-01-30 19:33:08 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:36800: 535 Incorrect authentication data (set_id=eng21a11118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-30 19:33:12 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:54502: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 194.233.82.52
domain: www.gvu.titopen.us
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config/php.ini||User:titlemas||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 19:33:28 ait sshd[1114510]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.110.46.223
description:
[2025-01-30 19:32:32 +0100] info [webmaild] 190.110.46.223 - news@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-30 19:32:48 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:56145: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 19:33:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 30 19:33:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
description:
Jan 30 19:33:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 19:33:28 ait sshd[1114510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 30 19:32:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Jan 30 19:32:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-32.80.76.51.123


