# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 28 16:18:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.163.214
description:
[2025-01-28 16:18:31 +0100] info [webmaild] 189.106.163.214 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.204.200
description:
[2025-01-28 16:18:36 +0100] info [webmaild] 179.108.204.200 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-28 16:18:21 dovecot_plain authenticator failed for (mailin) [88.87.84.104]:37901: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 28 16:19:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-28 16:19:05 dovecot_plain authenticator failed for (plones) [109.160.123.6]:33742: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 16:19:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 16:19:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.158.178
description:
[2025-01-28 16:20:23 +0100] info [webmaild] 177.124.158.178 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 16:19:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 16:19:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 16:20:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 16:19:47 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (ortient) [109.67.154.24]:55918: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.107.48.230
description:
[2025-01-28 16:19:49 +0100] info [webmaild] 185.107.48.230 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 16:19:50 dovecot_plain authenticator failed for (drifical) [81.211.77.58]:1428: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.185.42
description:
[2025-01-28 16:21:14 +0100] info [webmaild] 186.194.185.42 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.99.173.223
description:
[2025-01-28 16:22:03 +0100] info [webmaild] 86.99.173.223 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.62.47.246
description:
[2025-01-28 16:21:44 +0100] info [webmaild] 189.62.47.246 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.234.139.13
description:
[2025-01-28 16:21:58 +0100] info [webmaild] 91.234.139.13 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.7
description:
[2025-01-28 16:22:45 +0100] info [cpaneld] 156.228.102.7 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.203
description:
[2025-01-28 16:22:46 +0100] info [cpaneld] 156.228.80.203 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.82.210
description:
[2025-01-28 16:22:48 +0100] info [whostmgrd] 156.228.82.210 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.13
description:
[2025-01-28 16:22:50 +0100] info [whostmgrd] 104.207.39.13 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.97
description:
[2025-01-28 16:22:48 +0100] info [cpaneld] 154.214.1.97 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.162
description:
[2025-01-28 16:22:49 +0100] info [whostmgrd] 156.228.78.162 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.43.106
description:
[2025-01-28 16:22:46 +0100] info [cpaneld] 104.207.43.106 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.38
description:
[2025-01-28 16:22:50 +0100] info [whostmgrd] 104.207.61.38 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.82.223
description:
[2025-01-28 16:22:47 +0100] info [cpaneld] 156.228.82.223 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.225
description:
[2025-01-28 16:22:49 +0100] info [whostmgrd] 104.207.48.225 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.196
description:
[2025-01-28 16:22:51 +0100] info [whostmgrd] 104.207.56.196 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Jan 28 16:23:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
description:
Jan 28 16:24:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
description:
2025-01-28 16:24:20 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:49066: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 139.99.23.122
domain: gvu.titopen.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/2014/07/olx.php||SC:/home/titlemas/public_html/gvu/wp-content/uploads/2014


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.99.23.122
domain: gvu.titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-23.139.99.23.122||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.89.54.10
description:
Jan 28 16:24:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.89.54.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.54.10
description:
2025-01-28 16:24:19 dovecot_plain authenticator failed for ip10.ip-51-89-54.eu [51.89.54.10]:65467: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-28 16:23:47 dovecot_login authenticator failed for ([200.149.51.186]) [200.149.51.186]:36209: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
description:
Jan 28 16:25:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Jan 28 16:24:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 28 16:25:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.91.174.222
description:
[2025-01-28 16:25:23 +0100] info [webmaild] 77.91.174.222 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Jan 28 16:25:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-01-28 16:24:55 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:56886: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-28 16:25:16 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:57397: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.213.66
description:
Jan 28 16:25:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.213.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 28 16:25:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-01-28 16:25:33 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:52112: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
description:
2025-01-28 16:25:40 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:53470: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
description:
Jan 28 16:25:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
description:
2025-01-28 16:25:06 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:29286: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-28 16:25:24 dovecot_plain authenticator failed for ([90.161.217.228]) [90.161.217.228]:53641: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 16:26:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 16:26:18 dovecot_plain authenticator failed for (berum) [46.30.161.197]:43182: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.108.199.149
description:
[2025-01-28 16:26:29 +0100] info [webmaild] 85.108.199.149 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Jan 28 16:25:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-01-28 16:25:53 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:48242: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 16:26:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-26.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-01-28 16:27:21 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:57118: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 16:27:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 16:27:17 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (watate) [51.255.84.180]:44844: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Jan 28 16:27:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 16:27:52 ait sshd[3753855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 16:27:52 ait sshd[3753855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.91.178.116
description:
Jan 28 16:28:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.91.178.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Jan 28 16:27:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 16:27:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.91.178.116
description:
2025-01-28 16:28:11 dovecot_plain authenticator failed for pd95bb274.dip0.t-ipconnect.de (crove) [217.91.178.116]:41757: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-01-28 16:27:48 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:51290: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 16:28:38 ait sshd[3754383]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 16:28:38 ait sshd[3754383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.87.13
description:
[2025-01-28 16:27:53 +0100] info [webmaild] 45.183.87.13 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.218.18.109
description:
[2025-01-28 16:29:20 +0100] info [webmaild] 179.218.18.109 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Jan 28 16:29:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-01-28 16:29:26 dovecot_plain authenticator failed for (nmdq3t47z6xyfhyp9502w0l) [77.40.62.195]:21177: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 16:28:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 16:28:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.124.147
description:
Jan 28 16:30:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.124.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.155.177
description:
Jan 28 16:30:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.155.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.194.189.80
description:
[2025-01-28 16:30:10 +0100] info [webmaild] 168.194.189.80 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Jan 28 16:30:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Jan 28 16:30:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
description:
2025-01-28 16:30:27 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:42375: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-01-28 16:30:28 dovecot_login authenticator failed for ([132.247.87.75]) [132.247.87.75]:44856: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.155.177
description:
2025-01-28 16:30:38 dovecot_login authenticator failed for p84178-obmd01.osaka.ocn.ne.jp [180.7.155.177]:38448: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 28 16:30:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.8.218.54
description:
Jan 28 16:30:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.8.218.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-01-28 16:30:14 dovecot_login authenticator failed for ([188.226.132.113]) [188.226.132.113]:55190: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.124.147
description:
2025-01-28 16:30:35 dovecot_login authenticator failed for ([121.66.124.147]) [121.66.124.147]:59871: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
description:
Jan 28 16:30:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
description:
2025-01-28 16:30:38 dovecot_login authenticator failed for ([185.207.129.246]) [185.207.129.246]:37484: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 16:30:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.83.130
description:
[2025-01-28 16:29:45 +0100] info [webmaild] 182.48.83.130 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-28 16:30:02 dovecot_login authenticator failed for ([116.231.84.13]) [116.231.84.13]:58712: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.248.3
description:
2025-01-28 16:31:35 dovecot_plain authenticator failed for ([176.113.248.3]) [176.113.248.3]:38006: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Jan 28 16:30:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.185.4.26
description:
[2025-01-28 16:31:29 +0100] info [webmaild] 179.185.4.26 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.220.183.12
description:
[2025-01-28 16:31:20 +0100] info [webmaild] 178.220.183.12 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-28 16:31:08 dovecot_login authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:49612: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.113.248.3
description:
Jan 28 16:31:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.113.248.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.67.135
description:
[2025-01-28 16:30:48 +0100] info [webmaild] 167.250.67.135 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-01-28 16:30:55 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:53834: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Jan 28 16:31:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 28 16:31:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-28 16:31:57 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:42164: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.6
description:
Jan 28 16:31:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.6
description:
2025-01-28 16:32:01 dovecot_plain authenticator failed for 111-70-32-6.emome-ip.hinet.net [111.70.32.6]:55617: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 28 16:32:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 28 16:32:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-28 16:32:06 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:60420: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 28 16:32:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-28 16:32:38 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:42410: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 16:31:54 dovecot_login authenticator failed for ([109.166.70.166]) [109.166.70.166]:63980: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 28 16:31:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-01-28 16:31:55 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:36759: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-28 16:31:55 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:34028: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-28 16:32:08 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:32781: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 16:32:12 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:53494: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 28 16:31:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 28 16:32:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-01-28 16:32:07 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:36970: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.92.39
description:
[2025-01-28 16:32:16 +0100] info [webmaild] 187.108.92.39 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 16:32:12 ait sshd[3756424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
description:
Jan 28 16:32:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-28 16:32:21 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:34789: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 28 16:31:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Jan 28 16:31:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
description:
2025-01-28 16:32:18 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:50414: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
description:
2025-01-28 16:32:18 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:56204: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 28 16:32:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 28 16:31:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
description:
Jan 28 16:31:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.197
description:
2025-01-28 16:32:13 dovecot_login authenticator failed for (nlos-200-197.zamnet.zm) [196.46.200.197]:59041: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
description:
Jan 28 16:32:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 16:32:12 ait sshd[3756424]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Jan 28 16:32:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-28 16:31:48 dovecot_plain authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:48602: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 16:31:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 28 16:31:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 28 16:32:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 16:32:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.197
description:
Jan 28 16:32:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-01-28 16:32:26 dovecot_login authenticator failed for ([118.122.255.5]) [118.124.119.7]:18294: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-01-28 16:31:45 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:55576: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-01-28 16:31:51 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:49877: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-28 16:31:54 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:60628: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-28 16:31:55 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:47970: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-28 16:32:05 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:42286: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.124.130
description:
[2025-01-28 16:33:00 +0100] info [webmaild] 177.39.124.130 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.133.92
description:
[2025-01-28 16:34:14 +0100] info [webmaild] 177.105.133.92 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.117.197.238
description:
2025-01-28 16:34:25 dovecot_plain authenticator failed for net-109-117-197-238.cust.vodafonedsl.it [109.117.197.238]:60377: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
description:
Jan 28 16:34:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 16:34:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.117.197.238
description:
Jan 28 16:34:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.117.197.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.156.0.145
description:
[2025-01-28 16:34:42 +0100] info [webmaild] 177.156.0.145 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 16:33:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-01-28 16:35:34 dovecot_login authenticator failed for ([114.108.126.227]) [114.108.126.227]:46026: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 28 16:35:37 ait sshd[3758384]: Invalid user universitypublishing from 116.122.157.193 port 36984


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
description:
Jan 28 16:35:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-01-28 16:34:45 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:42910: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.98.184.78
description:
[2025-01-28 16:34:57 +0100] info [webmaild] 177.98.184.78 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.132.127.159
description:
[2025-01-28 16:34:59 +0100] info [webmaild] 186.132.127.159 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 16:35:37 ait sshd[3758384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Jan 28 16:35:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 16:35:37 ait sshd[3758384]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.81
description:
[2025-01-28 16:36:04 +0100] info [cpaneld] 156.228.101.81 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.90
description:
[2025-01-28 16:36:08 +0100] info [whostmgrd] 104.207.60.90 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.102
description:
[2025-01-28 16:36:10 +0100] info [whostmgrd] 104.207.60.102 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.82
description:
[2025-01-28 16:36:11 +0100] info [whostmgrd] 156.228.80.82 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.113
description:
[2025-01-28 16:36:11 +0100] info [whostmgrd] 104.207.40.113 - ads21b00230y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 16:36:39 ait sshd[3759329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.124.43.138
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-35.202.124.43.138


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 16:35:51 ait sshd[3758460]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 16:35:51 ait sshd[3758460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.195
description:
[2025-01-28 16:36:04 +0100] info [cpaneld] 156.228.125.195 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 16:36:39 ait sshd[3759329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 16:35:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.168
description:
[2025-01-28 16:36:12 +0100] info [whostmgrd] 156.228.101.168 - ads21b00230y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.118
description:
[2025-01-28 16:36:07 +0100] info [cpaneld] 156.228.111.118 - ads21b00230y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00230y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.186
description:
[2025-01-28 16:36:05 +0100] info [cpaneld] 104.207.42.186 - ads21b00230y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00230y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.73
description:
[2025-01-28 16:36:02 +0100] info [cpaneld] 156.228.106.73 - ads21b00230y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads21b00230y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.76.11
description:
[2025-01-28 16:36:09 +0100] info [whostmgrd] 156.228.76.11 - ads21b00230y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
description:
2025-01-28 16:35:45 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:46040: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.213.175.190
description:
Jan 28 16:36:54 ait sshd[3759560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.213.175.190


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 28 16:36:53 ait sshd[3759552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.175.190
description:
Jan 28 16:36:54 ait sshd[3759560]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.213.175.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 28 16:36:53 ait sshd[3759552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 16:38:29 ait sshd[3760562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.67.185.31
description:
[2025-01-28 16:38:40 +0100] info [webmaild] 181.67.185.31 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.13.242.140
description:
[2025-01-28 16:38:06 +0100] info [webmaild] 181.13.242.140 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 16:38:29 ait sshd[3760562]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-28 16:38:35 dovecot_plain authenticator failed for (sacchik) [77.239.255.163]:52180: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
description:
2025-01-28 16:37:51 dovecot_plain authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:50038: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 16:38:29 ait sshd[3760562]: Invalid user stichwort-marke.de 2a00 from 111.231.56.128 port 57726


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
description:
Jan 28 16:37:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-01-28 16:38:00 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:57781: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 16:38:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.72.143
description:
Jan 28 16:39:15 ait sshd[3761055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.72.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.5.159.34
description:
2025-01-28 16:39:41 dovecot_plain authenticator failed for ([45.5.159.34]) [45.5.159.34]:42468: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 16:39:42 ait sshd[3761389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.5.159.34
description:
Jan 28 16:39:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.5.159.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 16:39:42 ait sshd[3761389]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.180
description:
2025-01-28 16:39:59 dovecot_plain authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:53191: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.87.249.4
description:
[2025-01-28 16:40:30 +0100] info [webmaild] 187.87.249.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.213.175.190
description:
Jan 28 16:41:18 ait sshd[3762312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.213.175.190  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 28 16:40:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-28 16:40:47 dovecot_plain authenticator failed for (sembant) [185.65.238.250]:47563: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.175.190
description:
Jan 28 16:41:18 ait sshd[3762312]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.213.175.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.213.175.190
description:
Jan 28 16:42:27 ait sshd[3762878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.213.175.190


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.88.54.101
description:
[2025-01-28 16:42:04 +0100] info [webmaild] 213.88.54.101 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.96.75.233
description:
[2025-01-28 16:42:20 +0100] info [webmaild] 177.96.75.233 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 28 16:42:22 ait sshd[3762844]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.175.190
description:
Jan 28 16:42:27 ait sshd[3762878]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.213.175.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 28 16:42:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 16:42:26 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:44036: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 16:43:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.45.82.245
description:
[2025-01-28 16:43:38 +0100] info [webmaild] 181.45.82.245 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.141.81
description:
[2025-01-28 16:42:53 +0100] info [webmaild] 157.100.141.81 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.90.90.126
description:
[2025-01-28 16:44:15 +0100] info [webmaild] 168.90.90.126 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.175.17.44
description:
[2025-01-28 16:44:22 +0100] info [webmaild] 103.175.17.44 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.134
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Eng15a00111y||WPU:Eng15a00111y||RSV:6.65||T:APACHE||MV:16-44.170.205.31.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.172.230
description:
[2025-01-28 16:44:08 +0100] info [webmaild] 151.236.172.230 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.137.70
description:
Jan 28 16:45:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.137.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.241.15
description:
2025-01-28 16:45:19 dovecot_plain authenticator failed for broadband-5-228-241-15.ip.moscow.rt.ru [5.228.241.15]:50872: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-28 16:45:31 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:48585: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 16:45:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.137.70
description:
2025-01-28 16:45:42 dovecot_plain authenticator failed for (bl4.197.255.137.70.dynamic.dsl.cvmultimedia.cv) [197.255.137.70]:45218: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-01-28 16:45:59 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:16088: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.168.18.25
description:
Jan 28 16:45:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.168.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.168.18.25
description:
2025-01-28 16:45:48 dovecot_plain authenticator failed for (maked) [89.168.18.25]:54768: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.208.173
description:
[2025-01-28 16:45:56 +0100] info [webmaild] 190.115.208.173 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.67.195.17
description:
Jan 28 16:48:28 ait sshd[3766515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.67.195.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.67.195.17
description:
Jan 28 16:48:28 ait sshd[3766515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.195.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 16:48:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 16:49:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 16:49:58 ait sshd[3767319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 16:49:58 ait sshd[3767319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.61.31.139
description:
[2025-01-28 16:50:15 +0100] info [webmaild] 179.61.31.139 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 16:50:43 ait sshd[3767799]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 16:50:43 ait sshd[3767799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.50.206
description:
Jan 28 16:50:45 ait sshd[3767799]: Failed password for invalid user admissions from 146.190.50.206 port 46630 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 16:51:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 28 16:51:42 ait sshd[3768402]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 28 16:51:42 ait sshd[3768402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Jan 28 16:51:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-01-28 16:51:12 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:36086: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.35.15.43
description:
[2025-01-28 16:51:21 +0100] info [webmaild] 41.35.15.43 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
description:
2025-01-28 16:51:34 dovecot_plain authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:51877: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.235
description:
Jan 28 16:52:08 ait sshd[3768632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.235
description:
Jan 28 16:52:08 ait sshd[3768632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.235  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.219
description:
Jan 28 16:52:13 ait sshd[3768673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.219  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.219
description:
Jan 28 16:52:13 ait sshd[3768673]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.140.54.112
description:
[2025-01-28 16:53:02 +0100] info [webmaild] 200.140.54.112 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
description:
2025-01-28 16:53:17 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:57828: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-28 16:53:26 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (beiousia) [81.143.51.58]:40386: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-52.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-28 16:53:28 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:55044: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-01-28 16:54:20 dovecot_login authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:40070: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 16:54:26 ait sshd[3770158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=aitopen


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 16:54:26 ait sshd[3770158]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.137.248
description:
2025-01-28 16:54:11 dovecot_login authenticator failed for ([60.191.137.248]) [60.191.137.248]:33350: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Jan 28 16:54:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.130.9.177
description:
[2025-01-28 16:54:54 +0100] info [webmaild] 179.130.9.177 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.80
description:
[2025-01-28 16:55:42 +0100] info [webmaild] 84.54.73.80 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.37.71
description:
[2025-01-28 16:54:54 +0100] info [webmaild] 190.114.37.71 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.88.134.112
description:
[2025-01-28 16:56:07 +0100] info [webmaild] 176.88.134.112 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 16:56:20 ait sshd[3771593]: Invalid user stichwort-marke.de 2a00 from 111.231.56.128 port 53998


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 16:56:20 ait sshd[3771593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 16:56:20 ait sshd[3771593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.21.238
description:
[2025-01-28 16:56:25 +0100] info [webmaild] 181.78.21.238 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.88.103
description:
[2025-01-28 16:57:04 +0100] info [webmaild] 169.224.88.103 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
description:
2025-01-28 16:57:42 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:38220: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 16:57:02 ait sshd[3772063]: Invalid user evgenia-ulyanova.ru 2a01 from 122.51.104.242 port 45644


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.186.252.254
description:
[2025-01-28 16:56:56 +0100] info [webmaild] 91.186.252.254 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 16:57:02 ait sshd[3772063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 16:57:37 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:11744: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 28 16:57:27 ait sshd[3772191]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 28 16:57:27 ait sshd[3772191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 16:57:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
description:
Jan 28 16:58:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 16:57:47 ait sshd[3772298]: Invalid user evgenia-ulyanova.ru 2a01 from 122.51.104.242 port 33700


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 28 16:57:57 ait sshd[3772409]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.201.219
description:
[2025-01-28 16:58:41 +0100] info [webmaild] 45.4.201.219 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 16:57:47 ait sshd[3772298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 28 16:57:57 ait sshd[3772409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 16:57:58 +0100] info [cpaneld] 217.160.25.51 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
description:
2025-01-28 16:58:35 dovecot_login authenticator failed for ([220.178.201.58]) [220.178.201.58]:47702: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-01-28 16:57:55 dovecot_login authenticator failed for ([122.187.230.154]) [122.187.230.154]:46759: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-01-28 16:57:57 dovecot_login authenticator failed for ([151.83.71.207]) [151.83.71.207]:40438: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Jan 28 16:58:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.62
description:
2025-01-28 16:58:46 dovecot_login authenticator failed for p160063-obmd01.osaka.ocn.ne.jp [61.112.103.62]:50374: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-01-28 16:58:46 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:36989: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.112.193
description:
Jan 28 16:59:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.112.193
description:
2025-01-28 16:59:03 dovecot_login authenticator failed for 131.108.112.193.pontonetassai.com.br [131.108.112.193]:44436: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-01-28 16:59:14 dovecot_login authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:51530: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 16:59:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.131.172.138
description:
2025-01-28 17:00:02 dovecot_login authenticator failed for ([219.131.172.138]) [219.131.172.138]:52718: 535 Incorrect authentication data (set_id=eng20a00103y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.142
description:
2025-01-28 17:00:19 dovecot_plain authenticator failed for ([64.52.161.142]) [64.52.161.142]:46567: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.55.2
description:
[2025-01-28 17:00:29 +0100] info [webmaild] 143.255.55.2 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.52.161.142
description:
Jan 28 17:00:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.52.161.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.185.183.244
description:
[2025-01-28 16:59:48 +0100] info [webmaild] 178.185.183.244 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.117.186
description:
Jan 28 16:59:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.117.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.221
description:
Jan 28 16:59:57 ait sshd[3773410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.221  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.117.186
description:
2025-01-28 16:59:57 dovecot_plain authenticator failed for ([60.219.117.186]) [60.219.117.186]:39096: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.140.107.240
description:
[2025-01-28 17:00:19 +0100] info [webmaild] 177.140.107.240 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-28 16:59:48 dovecot_login authenticator failed for ([200.149.54.14]) [200.149.54.14]:47485: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.221
description:
Jan 28 16:59:56 ait sshd[3773410]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.131.172.138
description:
Jan 28 17:00:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.131.172.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.220.94.84
description:
[2025-01-28 17:00:29 +0100] info [webmaild] 178.220.94.84 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-28 17:00:52 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:49952: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 17:00:50 ait sshd[3774054]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 17:00:50 ait sshd[3774054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 28 17:00:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 17:01:08 ait sshd[3774324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 17:01:08 ait sshd[3774324]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.100.27
description:
2025-01-28 17:01:07 dovecot_login authenticator failed for ([183.24.100.27]) [183.24.100.27]:46218: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.100.27
description:
Jan 28 17:01:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.100.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.51.122.52
description:
[2025-01-28 17:01:55 +0100] info [webmaild] 38.51.122.52 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-01-28 17:02:31 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:50258: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 28 17:02:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-28 17:02:43 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:57714: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Jan 28 17:01:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-01-28 17:01:54 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:37056: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Jan 28 17:02:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-01-28 17:02:02 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:53483: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Jan 28 17:02:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.38.178
description:
[2025-01-28 17:04:22 +0100] info [webmaild] 201.71.38.178 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.107.68.123
description:
[2025-01-28 17:05:41 +0100] info [webmaild] 85.107.68.123 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.25.51
description:
2025-01-28 17:05:41 dovecot_plain authenticator failed for ([217.160.25.51]) [217.160.25.51]:54687: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 28 17:05:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.25.51
description:
Jan 28 17:05:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.160.25.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.25.51
description:
Jan 28 17:05:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.160.25.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.25.51
description:
2025-01-28 17:05:47 dovecot_login authenticator failed for ([217.160.25.51]) [217.160.25.51]:54687: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
description:
2025-01-28 17:05:58 dovecot_plain authenticator failed for ([211.243.43.30]) [211.243.43.30]:49832: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
description:
Jan 28 17:05:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.139.142
description:
Jan 28 17:06:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.139.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.139.142
description:
2025-01-28 17:06:10 dovecot_plain authenticator failed for ([211.43.139.142]) [211.43.139.142]:52022: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.155.71.16
description:
[2025-01-28 17:07:35 +0100] info [cpaneld] 41.155.71.16 - lemsas "GET /cpsess8295277737/frontend/jupiter/contact/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [41.218.199.172] != Current IP Address [41.155.71.16]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 28 17:07:36 ait sshd[3777680]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 28 17:07:36 ait sshd[3777680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.220.118.201
description:
Jan 28 17:07:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.220.118.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.220.118.201
description:
2025-01-28 17:07:05 dovecot_plain authenticator failed for 178-220-118-201.static.isp.telekom.rs (buized) [178.220.118.201]:53142: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.109.214
description:
[2025-01-28 17:07:34 +0100] info [webmaild] 45.169.109.214 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
description:
Jan 28 17:07:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Jan 28 17:07:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.248.251
description:
Jan 28 17:07:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.248.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 130.0.28.92
description:
[2025-01-28 17:07:32 +0100] info [webmaild] 130.0.28.92 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
description:
2025-01-28 17:07:11 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:41808: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 28 17:07:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-28 17:07:19 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:62731: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-01-28 17:07:26 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:57172: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-28 17:08:11 dovecot_plain authenticator failed for (pirist) [149.0.16.4]:56016: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 17:08:17 ait sshd[3778152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 28 17:08:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.171
description:
Jan 28 17:08:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.1.175.162
description:
Jan 28 17:08:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.1.175.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.114.117
description:
Jan 28 17:07:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.114.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.171
description:
2025-01-28 17:08:29 dovecot_plain authenticator failed for (megamism) [65.20.129.171]:51739: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 17:07:54 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (unceods) [51.255.84.180]:45356: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 17:08:17 ait sshd[3778152]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.152.83
description:
[2025-01-28 17:08:26 +0100] info [webmaild] 45.224.152.83 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.133.17
description:
[2025-01-28 17:07:47 +0100] info [webmaild] 168.195.133.17 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 17:07:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 17:08:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.134.200.16
description:
[2025-01-28 17:09:20 +0100] info [webmaild] 190.134.200.16 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.76
description:
[2025-01-28 17:09:41 +0100] info [webmaild] 84.54.73.76 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
description:
Jan 28 17:08:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 28 17:09:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.163.188.26
description:
[2025-01-28 17:09:44 +0100] info [webmaild] 201.163.188.26 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 28 17:11:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.222.122.5
description:
[2025-01-28 17:11:27 +0100] info [webmaild] 77.222.122.5 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 17:11:13 +0100] info [cpaneld] 217.160.25.51 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 17:11:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 28 17:11:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-28 17:11:04 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:59552: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-28 17:11:15 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:51836: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 17:12:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.61.32.99
description:
[2025-01-28 17:12:25 +0100] info [webmaild] 167.61.32.99 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Jan 28 17:12:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.22
description:
2025-01-28 17:13:07 dovecot_plain authenticator failed for ([122.228.225.22]) [122.228.225.22]:57359: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.101.124
description:
2025-01-28 17:13:27 dovecot_plain authenticator failed for ([186.96.101.124]) [186.96.101.124]:35631: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 28 17:13:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-28 17:13:17 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:58788: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.101.124
description:
Jan 28 17:13:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.101.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 28 17:13:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
description:
2025-01-28 17:13:38 dovecot_login authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:60152: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-01-28 17:12:57 dovecot_plain authenticator failed for ([116.114.94.242]) [116.114.94.242]:60932: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-12.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.188.89.138
description:
[2025-01-28 17:13:09 +0100] info [webmaild] 189.188.89.138 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.210.140.30
description:
[2025-01-28 17:13:29 +0100] info [webmaild] 179.210.140.30 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
description:
Jan 28 17:13:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-28 17:13:37 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:53026: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.22
description:
Jan 28 17:13:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.120.161
description:
[2025-01-28 17:13:08 +0100] info [webmaild] 157.100.120.161 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.46.243
description:
[2025-01-28 17:13:13 +0100] info [webmaild] 45.166.46.243 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
description:
Jan 28 17:13:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 28 17:13:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.229.4
description:
2025-01-28 17:13:57 dovecot_login authenticator failed for ([27.45.229.4]) [27.45.229.4]:43748: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-28 17:13:49 dovecot_login authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:45960: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
description:
Jan 28 17:13:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
description:
2025-01-28 17:13:47 dovecot_login authenticator failed for ([222.68.155.105]) [222.68.155.105]:53352: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.229.4
description:
Jan 28 17:13:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.229.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
description:
2025-01-28 17:14:00 dovecot_login authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:45911: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.74.36
description:
Jan 28 17:15:28 ait sshd[3781941]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.92.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.74.36
description:
Jan 28 17:15:28 ait sshd[3781941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.74.36  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
description:
2025-01-28 17:15:54 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:56042: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.196.11.219
description:
Jan 28 17:16:03 ait sshd[3782181]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.196.11.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Jan 28 17:16:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-01-28 17:16:20 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:46537: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
description:
Jan 28 17:15:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.196.11.219
description:
Jan 28 17:16:03 ait sshd[3782181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.196.11.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 17:16:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.100.232
description:
[2025-01-28 17:17:33 +0100] info [webmaild] 213.230.100.232 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.112.79.10
description:
Jan 28 17:18:34 ait sshd[3783587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.112.79.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.156.30
description:
[2025-01-28 17:18:19 +0100] info [webmaild] 186.249.156.30 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 17:18:29 ait sshd[3783564]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 39274


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 17:18:29 ait sshd[3783564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.112.79.10
description:
Jan 28 17:18:34 ait sshd[3783587]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.112.79.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Jan 28 17:18:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.196.11.219
description:
Jan 28 17:19:13 ait sshd[3783876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.196.11.219


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.74.36
description:
Jan 28 17:18:59 ait sshd[3783697]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.92.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.74.36
description:
Jan 28 17:18:59 ait sshd[3783697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.74.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.196.11.219
description:
Jan 28 17:19:13 ait sshd[3783876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.196.11.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.64.66.24
description:
[2025-01-28 17:19:21 +0100] info [webmaild] 177.64.66.24 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.196.11.219
description:
Jan 28 17:20:24 ait sshd[3784701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.196.11.219


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.219
description:
Jan 28 17:20:26 ait sshd[3784701]: Failed password for invalid user intell from 185.196.11.219 port 58530 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.93.188
description:
[2025-01-28 17:20:12 +0100] info [webmaild] 170.81.93.188 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.178.240
description:
[2025-01-28 17:20:18 +0100] info [webmaild] 177.72.178.240 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.196.11.219
description:
Jan 28 17:20:24 ait sshd[3784701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.196.11.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.116
description:
Jan 28 17:21:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
description:
Jan 28 17:21:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-01-28 17:21:31 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:54818: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.203.168.88
description:
[2025-01-28 17:21:01 +0100] info [webmaild] 177.203.168.88 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.116
description:
2025-01-28 17:21:14 dovecot_plain authenticator failed for ([122.187.227.116]) [122.187.227.116]:52774: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Jan 28 17:22:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.11.206
description:
[2025-01-28 17:22:07 +0100] info [webmaild] 177.8.11.206 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 17:22:14 ait sshd[3785726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.58.205.132
description:
2025-01-28 17:22:34 dovecot_plain authenticator failed for (64-58-205-132-yelcot.com) [64.58.205.132]:51360: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.67.6.244
description:
[2025-01-28 17:22:26 +0100] info [webmaild] 187.67.6.244 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.35.243
description:
[2025-01-28 17:22:29 +0100] info [webmaild] 138.122.35.243 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.58.205.132
description:
Jan 28 17:22:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.58.205.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
description:
2025-01-28 17:23:33 dovecot_login authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:38252: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.102
description:
2025-01-28 17:23:38 dovecot_login authenticator failed for ([102.69.163.102]) [102.69.163.102]:49653: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
description:
Jan 28 17:23:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.112.79.10
description:
Jan 28 17:23:15 ait sshd[3786297]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.112.79.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
description:
Jan 28 17:23:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.102
description:
Jan 28 17:23:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-01-28 17:23:11 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:57860: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.35
description:
Jan 28 17:23:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 28 17:23:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.180.52.57
description:
2025-01-28 17:23:23 dovecot_plain authenticator failed for i15-les03-ix2-176-180-52-57.dsl.dyn.abo.bbox.fr (shasm) [176.180.52.57]:53711: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-01-28 17:23:33 dovecot_login authenticator failed for ([31.173.9.222]) [31.173.9.222]:58522: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
description:
Jan 28 17:23:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.187.154
description:
Jan 28 17:23:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.187.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.90.239.158
description:
Jan 28 17:22:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.90.239.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.49.225.218
description:
Jan 28 17:23:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.49.225.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 28 17:23:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-28 17:23:44 dovecot_login authenticator failed for ([95.0.252.72]) [95.0.252.72]:47806: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
description:
Jan 28 17:23:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Jan 28 17:23:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
description:
2025-01-28 17:23:33 dovecot_login authenticator failed for ([154.127.43.35]) [154.127.43.35]:45607: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
description:
2025-01-28 17:23:44 dovecot_login authenticator failed for ([113.193.187.154]) [113.193.187.154]:41368: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-01-28 17:22:44 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:11839: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.180.52.57
description:
Jan 28 17:23:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.180.52.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-28 17:23:37 dovecot_login authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:52198: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
description:
2025-01-28 17:23:40 dovecot_login authenticator failed for ([36.34.244.190]) [36.34.244.190]:36972: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.112.79.10
description:
Jan 28 17:23:15 ait sshd[3786297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.112.79.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-01-28 17:23:33 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:57131: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.49.225.218
description:
2025-01-28 17:23:44 dovecot_login authenticator failed for (161.49.225.218.convergeict.com) [161.49.225.218]:57233: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
description:
2025-01-28 17:23:01 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:15774: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Jan 28 17:23:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Jan 28 17:24:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.16.30
description:
[2025-01-28 17:24:08 +0100] info [webmaild] 102.0.16.30 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
description:
Jan 28 17:24:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 28 17:24:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.194
description:
Jan 28 17:23:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.64.20
description:
Jan 28 17:24:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.64.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-28 17:24:05 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:4618: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 28 17:24:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 28 17:24:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
description:
2025-01-28 17:23:45 dovecot_login authenticator failed for ([61.186.136.36]) [61.186.136.36]:39484: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.82.233.7
description:
Jan 28 17:23:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.82.233.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
description:
Jan 28 17:23:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
description:
2025-01-28 17:24:02 dovecot_login authenticator failed for (92.62.243.174.fibermax.bg) [92.62.243.174]:56132: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-01-28 17:24:03 dovecot_login authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:49776: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.114.171
description:
Jan 28 17:23:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.114.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.132.229.196
description:
2025-01-28 17:24:00 dovecot_login authenticator failed for ([185.132.229.196]) [185.132.229.196]:47287: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.71.106
description:
Jan 28 17:24:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.71.106
description:
2025-01-28 17:24:09 dovecot_login authenticator failed for (abts-kk-static-106.71.166.122.airtelbroadband.in) [122.166.71.106]:56364: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-28 17:24:09 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:2483: 535 Incorrect authentication data (set_id=21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.141.152
description:
2025-01-28 17:24:20 dovecot_login authenticator failed for ([5.59.141.152]) [5.59.141.152]:52358: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-28 17:24:22 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com (ovignon) [46.162.74.47]:58559: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Jan 28 17:23:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.233.7
description:
2025-01-28 17:23:48 dovecot_login authenticator failed for ([223.82.233.7]) [223.82.233.7]:41510: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-01-28 17:23:48 dovecot_login authenticator failed for ([185.255.212.146]) [185.255.212.146]:52762: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
description:
Jan 28 17:24:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.205.83
description:
Jan 28 17:24:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.205.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
description:
2025-01-28 17:23:46 dovecot_login authenticator failed for ([2.55.114.171]) [2.55.114.171]:37832: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Jan 28 17:23:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.132.229.196
description:
Jan 28 17:23:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.132.229.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 28 17:24:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-01-28 17:24:15 dovecot_login authenticator failed for ([175.156.154.149]) [175.156.154.149]:41184: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-28 17:24:05 dovecot_login authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:50843: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Jan 28 17:24:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.52.230
description:
47.128.52.230 - - [28/Jan/2025:17:23:45 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5127302" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.230


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.143.103.173
description:
Jan 28 17:23:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.143.103.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-01-28 17:23:49 dovecot_login authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:45217: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.103.173
description:
2025-01-28 17:23:49 dovecot_login authenticator failed for 173.sub-166-143-103.myvzw.com [166.143.103.173]:12275: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
description:
2025-01-28 17:23:57 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:58455: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Jan 28 17:24:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
description:
2025-01-28 17:24:18 dovecot_login authenticator failed for ([187.9.3.190]) [187.9.3.190]:48705: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.141.152
description:
Jan 28 17:24:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.141.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-28 17:24:19 dovecot_plain authenticator failed for (panubrule) [91.126.196.67]:38250: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
description:
2025-01-28 17:24:00 dovecot_plain authenticator failed for (sadore) [65.20.148.194]:55816: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 28 17:24:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.64.20
description:
2025-01-28 17:24:04 dovecot_login authenticator failed for ([94.207.64.20]) [94.207.64.20]:33818: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.205.83
description:
2025-01-28 17:24:05 dovecot_login authenticator failed for ([112.164.205.83]) [112.164.205.83]:39724: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-01-28 17:24:27 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.157.111]:36622: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.190.63.252
description:
[2025-01-28 17:25:17 +0100] info [webmaild] 187.190.63.252 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.112.79.10
description:
Jan 28 17:25:09 ait sshd[3787456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.112.79.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.112.79.10
description:
Jan 28 17:25:09 ait sshd[3787456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.112.79.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.12.164
description:
[2025-01-28 17:25:16 +0100] info [webmaild] 177.221.12.164 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
description:
2025-01-28 17:25:58 dovecot_plain authenticator failed for ([183.249.1.72]) [183.249.1.72]:43145: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.10.62.161
description:
[2025-01-28 17:26:00 +0100] info [webmaild] 177.10.62.161 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.7.180.109
description:
[2025-01-28 17:26:04 +0100] info [webmaild] 179.7.180.109 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 28 17:25:59 ait sshd[3788121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.217.151.201
description:
[2025-01-28 17:25:52 +0100] info [webmaild] 62.217.151.201 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
description:
Jan 28 17:25:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 28 17:25:59 ait sshd[3788121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
description:
Jan 28 17:26:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
description:
2025-01-28 17:26:21 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:58136: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 17:27:08 ait sshd[3788732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 17:27:08 ait sshd[3788732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.197.126.103
description:
2025-01-28 17:27:14 dovecot_plain authenticator failed for (agism) [2.197.126.103]:46926: 535 Incorrect authentication data (set_id=ait.edu.gh@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 17:27:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.197.126.103
description:
Jan 28 17:27:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.197.126.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 17:27:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 28 17:27:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-28 17:28:10 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (oxechotion) [83.254.126.238]:45726: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 17:28:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-28 17:27:45 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:41560: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
description:
2025-01-28 17:28:01 dovecot_plain authenticator failed for ([117.158.166.73]) [117.158.166.73]:18928: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 28 17:28:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.166.73
description:
Jan 28 17:27:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.166.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 17:29:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
description:
Jan 28 17:29:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
description:
2025-01-28 17:29:42 dovecot_plain authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:53282: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.18.20
description:
47.128.18.20 - - [28/Jan/2025:17:29:02 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18751368 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?duration=short%2Clong&filter_course-category=205&filtering=1&instructor=2&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.18.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
description:
2025-01-28 17:30:19 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:51879: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Jan 28 17:30:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 17:30:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.196.60.148
description:
Jan 28 17:29:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.196.60.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.196.60.148
description:
2025-01-28 17:29:46 dovecot_plain authenticator failed for (tring) [156.196.60.148]:34284: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 28 17:29:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
description:
Jan 28 17:30:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 205.164.157.16
description:
[2025-01-28 17:30:19 +0100] info [webmaild] 205.164.157.16 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-28 17:29:51 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:27263: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-01-28 17:30:07 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:46438: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.171.86
description:
[2025-01-28 17:31:01 +0100] info [webmaild] 45.5.171.86 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.30.11.243
description:
[2025-01-28 17:31:17 +0100] info [webmaild] 147.30.11.243 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 17:32:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.19.123.111
description:
[2025-01-28 17:32:54 +0100] info [webmaild] 186.19.123.111 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.75.41.228
description:
[2025-01-28 17:33:05 +0100] info [webmaild] 196.75.41.228 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 17:33:18 ait sshd[3792537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 17:33:18 ait sshd[3792537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.190.4
description:
[2025-01-28 17:34:17 +0100] info [webmaild] 37.236.190.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 28 17:35:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.165.222
description:
Jan 28 17:35:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-01-28 17:35:41 dovecot_plain authenticator failed for (ezvu933i7qzyw6h0p7uw4p7j) [77.40.62.195]:15258: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 205.164.241.41
description:
[2025-01-28 17:35:15 +0100] info [webmaild] 205.164.241.41 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-28 17:35:23 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:52992: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.165.222
description:
2025-01-28 17:35:33 dovecot_plain authenticator failed for ([183.247.165.222]) [183.247.165.222]:50094: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Jan 28 17:35:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.87.63
description:
[2025-01-28 17:35:44 +0100] info [webmaild] 191.5.87.63 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.167.200.175
description:
[2025-01-28 17:34:55 +0100] info [webmaild] 213.167.200.175 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-28 17:36:39 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (canke) [2.139.88.148]:44162: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Jan 28 17:35:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-01-28 17:35:47 dovecot_plain authenticator failed for (6dp3m1d463ht69091o4sl7bewx53p0) [77.40.62.195]:22721: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 28 17:36:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.88.217.159
description:
[2025-01-28 17:37:04 +0100] info [webmaild] 178.88.217.159 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.11.194
description:
[2025-01-28 17:37:10 +0100] info [webmaild] 168.197.11.194 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-28 17:38:07 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:52150: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 28 17:38:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 28 17:38:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.71.65.15
description:
[2025-01-28 17:38:22 +0100] info [webmaild] 200.71.65.15 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-28 17:38:24 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:41352: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 28 17:38:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.25.42
description:
[2025-01-28 17:38:49 +0100] info [webmaild] 177.72.25.42 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.224.193
description:
[2025-01-28 17:38:50 +0100] info [webmaild] 45.236.224.193 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.244.113.178
description:
Jan 28 17:39:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.244.113.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.49.187
description:
47.128.49.187 - - [28/Jan/2025:17:39:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23800151 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?filtering=1&instructor=2&level=intermediate%2Cbeginner%2Call_levels&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.49.187


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
description:
2025-01-28 17:39:24 dovecot_plain authenticator failed for ([91.244.113.178]) [91.244.113.178]:55308: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 28 17:39:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.245.98
description:
[2025-01-28 17:39:07 +0100] info [webmaild] 177.105.245.98 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-28 17:39:09 dovecot_plain authenticator failed for ([121.142.146.167]) [121.142.146.167]:42814: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
description:
Jan 28 17:40:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
description:
2025-01-28 17:40:23 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:34726: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-28 17:40:40 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:40968: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 28 17:40:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 28 17:41:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 28 17:41:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-28 17:41:24 dovecot_login authenticator failed for ([219.139.41.6]) [219.139.41.6]:50802: 535 Incorrect authentication data (set_id=osngsua)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-28 17:41:12 dovecot_login authenticator failed for ([150.242.239.128]) [222.68.153.94]:60223: 535 Incorrect authentication data (set_id=osngsua@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Jan 28 17:42:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.67
description:
Jan 28 17:42:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.67 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-42.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
description:
2025-01-28 17:43:06 dovecot_plain authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:51412: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.39.197.107
description:
[2025-01-28 17:43:19 +0100] info [webmaild] 37.39.197.107 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.121.30.164
description:
[2025-01-28 17:43:03 +0100] info [webmaild] 178.121.30.164 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 28 17:42:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
description:
Jan 28 17:43:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-28 17:42:56 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:56006: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Jan 28 17:44:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-01-28 17:44:41 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:50191: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.101.100.32
description:
Jan 28 17:43:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.101.100.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 28 17:44:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-28 17:44:11 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:37632: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-01-28 17:44:20 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:49032: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
description:
Jan 28 17:44:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.104.117.61
description:
[2025-01-28 17:43:43 +0100] info [webmaild] 212.104.117.61 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.101.100.32
description:
2025-01-28 17:43:56 dovecot_plain authenticator failed for dynamic-acs-24-101-100-32.zoominternet.net [24.101.100.32]:36047: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.146.200
description:
[2025-01-28 17:45:35 +0100] info [webmaild] 177.137.146.200 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 17:46:09 ait sshd[3800108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.200.226.73
description:
[2025-01-28 17:45:44 +0100] info [webmaild] 46.200.226.73 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 17:46:08 ait sshd[3800108]: Invalid user evgenia-ulyanova.ru 2a01 from 122.51.104.242 port 55190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.10
description:
2025-01-28 17:46:39 dovecot_plain authenticator failed for ([103.106.154.10]) [103.106.154.10]:38047: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 17:46:09 ait sshd[3800108]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-01-28 17:46:37 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:52557: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.10
description:
Jan 28 17:46:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 28 17:46:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
description:
Jan 28 17:48:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
description:
2025-01-28 17:48:15 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:51719: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Jan 28 17:48:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 17:47:44 ait sshd[3800969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.235.125.241
description:
[2025-01-28 17:47:49 +0100] info [webmaild] 41.235.125.241 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.171.112
description:
[2025-01-28 17:47:53 +0100] info [webmaild] 201.71.171.112 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
description:
Jan 28 17:48:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
description:
2025-01-28 17:48:32 dovecot_plain authenticator failed for ([103.132.199.18]) [103.132.199.18]:25532: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-01-28 17:48:09 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:63865: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-01-28 17:48:27 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:44722: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
description:
Jan 28 17:48:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 17:47:44 ait sshd[3800969]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.91.85.88
description:
[2025-01-28 17:48:51 +0100] info [webmaild] 181.91.85.88 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 28 17:49:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-28 17:49:11 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:34463: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.220.41.114
description:
[2025-01-28 17:48:55 +0100] info [webmaild] 91.220.41.114 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 17:49:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
description:
2025-01-28 17:49:42 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:26157: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.6
description:
Jan 28 17:49:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.6
description:
2025-01-28 17:49:52 dovecot_login authenticator failed for ([104.241.231.6]) [104.241.231.6]:46088: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 17:50:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-01-28 17:49:59 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:52364: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.139.219
description:
[2025-01-28 17:50:04 +0100] info [webmaild] 186.68.139.219 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Jan 28 17:49:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-28 17:49:52 dovecot_plain authenticator failed for ([61.169.31.242]) [61.169.31.242]:44573: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Jan 28 17:49:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 28 17:51:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-28 17:51:18 dovecot_login authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:38836: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.164.185.13
description:
Jan 28 17:51:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.164.185.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.244.208.20
description:
[2025-01-28 17:51:42 +0100] info [webmaild] 197.244.208.20 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.50.155
description:
Jan 28 17:51:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.50.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.57.106
description:
Jan 28 17:51:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.57.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.57.106
description:
2025-01-28 17:51:19 dovecot_login authenticator failed for ([65.76.57.106]) [65.76.57.106]:56560: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-28 17:51:39 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:9735: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.133.238.99
description:
Jan 28 17:50:44 ait sshd[3802829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.133.238.99  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
description:
2025-01-28 17:51:16 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:34643: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.53.104.53
description:
[2025-01-28 17:51:26 +0100] info [webmaild] 186.53.104.53 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.60
description:
Jan 28 17:51:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.60
description:
2025-01-28 17:51:30 dovecot_login authenticator failed for ([163.179.123.60]) [163.179.123.60]:58148: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 28 17:51:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.164.185.13
description:
2025-01-28 17:51:26 dovecot_login authenticator failed for (5x164x185x13.dynamic.samara.ertelecom.ru) [5.164.185.13]:49567: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 17:52:37 ait sshd[3803788]: Invalid user evgenia-ulyanova.ru 2a01 from 122.51.104.242 port 35152


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 17:52:37 ait sshd[3803788]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 17:51:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.169.121
description:
[2025-01-28 17:52:08 +0100] info [webmaild] 45.230.169.121 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 17:52:37 ait sshd[3803788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.182.87
description:
[2025-01-28 17:51:46 +0100] info [webmaild] 103.151.182.87 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 17:53:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.103.125.93
description:
[2025-01-28 17:54:38 +0100] info [webmaild] 103.103.125.93 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 17:54:30 ait sshd[3804854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.107.44
description:
Jan 28 17:54:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.107.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 28 17:53:47 ait sshd[3804512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 17:54:30 ait sshd[3804854]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 51302


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 28 17:53:47 ait sshd[3804512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 17:54:30 ait sshd[3804854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.44
description:
2025-01-28 17:54:44 dovecot_plain authenticator failed for 110-25-107-44.adsl.fetnet.net [110.25.107.44]:46999: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 17:54:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-01-28 17:54:53 dovecot_plain authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:57605: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.220.180.224
description:
[2025-01-28 17:56:14 +0100] info [webmaild] 191.220.180.224 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.121.249
description:
[2025-01-28 17:56:15 +0100] info [webmaild] 186.235.121.249 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.109.164.46
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:17-56.65.109.164.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 17:58:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 17:58:16 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:64683: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.102.231
description:
[2025-01-28 17:58:17 +0100] info [webmaild] 131.196.102.231 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 28 17:58:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.155.17.195
description:
[2025-01-28 17:58:03 +0100] info [webmaild] 178.155.17.195 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-28 17:58:03 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:23206: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Jan 28 17:58:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-01-28 17:58:06 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:34140: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Jan 28 17:58:22 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-01-28 17:58:24 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:37176: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
description:
Jan 28 17:59:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-28 17:58:55 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:50062: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
description:
Jan 28 17:59:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-28 17:59:34 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:36337: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.26.86
description:
Jan 28 17:59:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.26.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 28 17:58:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.26.86
description:
2025-01-28 17:59:39 dovecot_plain authenticator failed for ([65.76.26.86]) [65.76.26.86]:34892: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
description:
2025-01-28 17:59:18 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:38780: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 17:59:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.158.98.155
description:
[2025-01-28 17:59:40 +0100] info [webmaild] 146.158.98.155 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
description:
2025-01-28 17:59:08 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:59011: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.154.6.212
description:
[2025-01-28 18:00:37 +0100] info [webmaild] 177.154.6.212 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.212.2.26
description:
[2025-01-28 18:00:24 +0100] info [webmaild] 37.212.2.26 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.61.9
description:
[2025-01-28 18:00:26 +0100] info [webmaild] 91.106.61.9 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.227.211.119
description:
Jan 28 18:01:36 ait sshd[3809173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.211.119


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.139.212.206
description:
Jan 28 18:01:42 ait sshd[3809216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.139.212.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 18:01:06 ait sshd[3809024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
description:
Jan 28 18:01:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
description:
2025-01-28 18:01:31 dovecot_plain authenticator failed for (187-50-67-114.customer.tdatabrasil.net.br) [187.50.67.114]:57521: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 18:01:06 ait sshd[3809024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.246.7
description:
[2025-01-28 18:01:29 +0100] info [webmaild] 177.105.246.7 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.227.211.119
description:
Jan 28 18:01:36 ait sshd[3809173]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.227.211.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.139.212.206
description:
Jan 28 18:01:42 ait sshd[3809216]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.139.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.172.153.100
description:
Jan 28 18:02:11 ait sshd[3809467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.172.153.100


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.139.212.206
description:
Jan 28 18:01:45 ait sshd[3809216]: Failed password for invalid user mirjam from 150.139.212.206 port 56510 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
description:
Jan 28 18:01:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
description:
2025-01-28 18:01:48 dovecot_plain authenticator failed for ([39.155.170.146]) [39.155.170.146]:60422: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-01-28 18:03:25 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:37850: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-01-28 18:03:34 dovecot_plain authenticator failed for ([61.169.31.242]) [61.169.31.242]:52164: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Jan 28 18:03:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.190.153.226
description:
Jan 28 18:03:07 ait sshd[3809852]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.190.153.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.191.4
description:
Jan 28 18:03:12 ait sshd[3809868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.191.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.206.231
description:
[2025-01-28 18:03:02 +0100] info [webmaild] 170.150.206.231 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Jan 28 18:03:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Jan 28 18:03:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.190.153.226
description:
Jan 28 18:03:07 ait sshd[3809852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.190.153.226  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.191.4
description:
Jan 28 18:03:12 ait sshd[3809868]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.191.4 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 18:04:03 ait sshd[3810380]: Invalid user evgenia-ulyanova.ru 2a01 from 122.51.104.242 port 40130


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.41.58.22
description:
[2025-01-28 18:04:10 +0100] info [webmaild] 176.41.58.22 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-01-28 18:03:45 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:59260: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.190.153.226
description:
Jan 28 18:04:26 ait sshd[3810458]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.190.153.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.247.239.222
description:
[2025-01-28 18:04:30 +0100] info [webmaild] 170.247.239.222 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.190.153.226
description:
Jan 28 18:04:26 ait sshd[3810458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.190.153.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-01-28 18:03:46 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:47473: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 18:04:04 ait sshd[3810380]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 18:04:04 ait sshd[3810380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.75.117.141
description:
[2025-01-28 18:04:24 +0100] info [webmaild] 177.75.117.141 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.13.177.206
description:
[2025-01-28 18:05:00 +0100] info [webmaild] 191.13.177.206 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.139.212.206
description:
Jan 28 18:05:17 ait sshd[3810940]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.139.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.139.212.206
description:
Jan 28 18:05:17 ait sshd[3810940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.139.212.206


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.190.153.226
description:
Jan 28 18:05:40 ait sshd[3811036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.190.153.226


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.190.153.226
description:
Jan 28 18:05:40 ait sshd[3811036]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.190.153.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.227.211.119
description:
Jan 28 18:05:41 ait sshd[3811039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.227.211.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.227.211.119
description:
Jan 28 18:05:41 ait sshd[3811039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.211.119


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.191.4
description:
Jan 28 18:06:17 ait sshd[3811471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.191.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.7.189
description:
Jan 28 18:06:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.7.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.191.4
description:
Jan 28 18:06:17 ait sshd[3811471]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.191.4 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 28 18:06:26 ait sshd[3811509]: Invalid user universitypublishing from 175.126.195.176 port 58881


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 18:06:26 ait sshd[3811509]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 18:06:26 ait sshd[3811509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 18:05:50 ait sshd[3811119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.172.153.100
description:
Jan 28 18:06:13 ait sshd[3811429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.172.153.100


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 18:06:32 ait sshd[3811082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.84.172.52
description:
[2025-01-28 18:06:33 +0100] info [webmaild] 206.84.172.52 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 18:06:32 ait sshd[3811082]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.7.189
description:
2025-01-28 18:06:38 dovecot_plain authenticator failed for 111-70-7-189.emome-ip.hinet.net [111.70.7.189]:45313: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
description:
Jan 28 18:06:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
description:
2025-01-28 18:06:26 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:44524: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.58.136
description:
47.128.58.136 - - [28/Jan/2025:18:07:00 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8130617" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.136


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.4
description:
Jan 28 18:07:35 ait sshd[3812065]: Failed password for invalid user sugon from 195.178.191.4 port 48384 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.227.211.119
description:
Jan 28 18:07:37 ait sshd[3812112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.211.119


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.139.212.206
description:
Jan 28 18:07:36 ait sshd[3812068]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.139.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.227.211.119
description:
Jan 28 18:07:37 ait sshd[3812112]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.227.211.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.191.4
description:
Jan 28 18:07:33 ait sshd[3812065]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.191.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.191.4
description:
Jan 28 18:07:33 ait sshd[3812065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.191.4


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.139.212.206
description:
Jan 28 18:07:36 ait sshd[3812068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.139.212.206


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.172.153.100
description:
Jan 28 18:07:37 ait sshd[3812095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.172.153.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Jan 28 18:08:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.59.34.5
description:
Jan 28 18:08:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.59.34.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
description:
2025-01-28 18:08:21 dovecot_plain authenticator failed for ([113.59.34.8]) [113.59.34.5]:52891: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 18:08:30 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (subvily) [87.103.126.54]:55578: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.89.54.10
description:
Jan 28 18:08:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.89.54.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.136.107.13
description:
[2025-01-28 18:08:38 +0100] info [webmaild] 178.136.107.13 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 18:08:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.54.10
description:
2025-01-28 18:08:36 dovecot_plain authenticator failed for ip10.ip-51-89-54.eu [51.89.54.10]:63746: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-01-28 18:08:03 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:44453: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-28 18:09:34 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:53679: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Jan 28 18:09:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 28 18:09:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.103.241.132
description:
[2025-01-28 18:09:05 +0100] info [webmaild] 41.103.241.132 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.234.208
description:
Jan 28 18:09:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.234.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.234.208
description:
2025-01-28 18:09:20 dovecot_plain authenticator failed for (deenetservices.net) [103.89.234.208]:59390: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-01-28 18:09:30 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1918: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
description:
Jan 28 18:09:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.174
description:
Jan 28 18:09:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.24.93
description:
Jan 28 18:09:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.24.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
description:
Jan 28 18:09:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.174
description:
2025-01-28 18:09:46 dovecot_plain authenticator failed for ([218.149.228.174]) [218.149.228.174]:45735: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
description:
2025-01-28 18:09:51 dovecot_plain authenticator failed for ([85.12.240.14]) [85.12.240.14]:50598: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.24.93
description:
2025-01-28 18:10:00 dovecot_plain authenticator failed for ([218.149.24.93]) [218.149.24.93]:44822: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
description:
Jan 28 18:10:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.112.80.11
description:
[2025-01-28 18:10:27 +0100] info [webmaild] 85.112.80.11 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-01-28 18:09:45 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:37685: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
description:
2025-01-28 18:10:18 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:56471: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 28 18:11:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 41.155.71.16
domain: helpdesk.ait-ext.com
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/admin/admin_settings_general.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-28 18:11:39 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:6687: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.218.72.253
description:
[2025-01-28 18:10:46 +0100] info [webmaild] 31.218.72.253 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.125.102
description:
47.128.125.102 - - [28/Jan/2025:18:11:51 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20694140 HTTP/2.0" 302 0 ait-open.net "https://ait-open.net/elearning/mod/resource/view.php?__im-ozAdcbfi=13960070603715948639&id=10559" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.125.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 203.101.190.152
description:
[2025-01-28 18:12:20 +0100] info [webmaild] 203.101.190.152 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 28 18:11:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-28 18:11:55 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:50102: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.97.243.36
description:
[2025-01-28 18:12:18 +0100] info [webmaild] 200.97.243.36 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.179.177.117
description:
[2025-01-28 18:13:18 +0100] info [webmaild] 160.179.177.117 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-13.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.117.62.178
description:
[2025-01-28 18:12:55 +0100] info [webmaild] 45.117.62.178 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.116.25.132
description:
[2025-01-28 18:14:02 +0100] info [webmaild] 177.116.25.132 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 28 18:14:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Jan 28 18:14:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.11
description:
Jan 28 18:14:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.11
description:
2025-01-28 18:14:19 dovecot_plain authenticator failed for (ppp11-lumwana.zamnet.zm) [196.46.199.11]:42750: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-28 18:14:20 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:49230: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 18:14:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-28 18:14:33 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:34074: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 28 18:14:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 28 18:14:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-28 18:14:34 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:45458: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 28 18:14:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-01-28 18:14:51 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:39987: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
description:
2025-01-28 18:14:55 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:51527: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Jan 28 18:15:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
description:
2025-01-28 18:15:12 dovecot_plain authenticator failed for 111-70-23-248.emome-ip.hinet.net [111.70.23.248]:53165: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-01-28 18:14:44 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:33993: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 28 18:14:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 28 18:14:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-28 18:14:52 dovecot_plain authenticator failed for (tonon) [109.108.95.66]:43219: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-28 18:14:50 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:20109: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
description:
Jan 28 18:14:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-28 18:15:07 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:40812: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.248
description:
Jan 28 18:15:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.113
description:
Jan 28 18:16:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
description:
2025-01-28 18:16:38 dovecot_plain authenticator failed for ([130.185.96.113]) [130.185.96.113]:51508: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.171.83
description:
[2025-01-28 18:15:50 +0100] info [webmaild] 177.87.171.83 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 18:17:38 ait sshd[3817819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.222.223
description:
[2025-01-28 18:17:10 +0100] info [webmaild] 45.179.222.223 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.249.90.214
description:
[2025-01-28 18:17:01 +0100] info [webmaild] 41.249.90.214 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 28 18:17:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 18:17:04 ait sshd[3817562]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 18:17:38 ait sshd[3817819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.231.66.204
description:
[2025-01-28 18:17:42 +0100] info [webmaild] 91.231.66.204 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.16.228.233
description:
[2025-01-28 18:16:58 +0100] info [webmaild] 46.16.228.233 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 185.130.249.241
description:
2025-01-28 18:18:09 H=s1099201.srvape.com [185.130.249.241]:54622 F=<ghjsbggdbh@yetbhhd.com> rejected RCPT <jamie88@lemsas.net>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.96.71.85
description:
[2025-01-28 18:18:13 +0100] info [webmaild] 103.96.71.85 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 18:18:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-28 18:19:06 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:34326: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 28 18:18:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-28 18:18:54 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:53618: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 28 18:19:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 28 18:20:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 18:20:20 +0100] info [webmaild] 217.160.25.51 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.221.198.75
description:
Jan 28 18:20:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.221.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.198.75
description:
2025-01-28 18:20:29 dovecot_plain authenticator failed for ([185.221.198.75]) [185.221.198.75]:59274: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-28 18:20:43 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:41201: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.105.45
description:
[2025-01-28 18:21:02 +0100] info [webmaild] 169.224.105.45 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 18:21:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 28 18:21:15 ait sshd[3819515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 28 18:21:15 ait sshd[3819515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.177.237.7
description:
[2025-01-28 18:21:43 +0100] info [webmaild] 196.177.237.7 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
description:
Jan 28 18:21:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
description:
2025-01-28 18:23:22 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:52749: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.200.15.212
description:
[2025-01-28 18:22:52 +0100] info [webmaild] 213.200.15.212 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
description:
Jan 28 18:23:10 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
description:
2025-01-28 18:23:12 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:57670: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.208.210
description:
[2025-01-28 18:23:13 +0100] info [webmaild] 138.204.208.210 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Jan 28 18:23:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Jan 28 18:23:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.62.44.85
description:
[2025-01-28 18:24:00 +0100] info [webmaild] 189.62.44.85 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Jan 28 18:24:09 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-01-28 18:24:11 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:60874: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 18:24:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-01-28 18:23:56 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:37209: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 150.107.107.34
description:
[2025-01-28 18:24:39 +0100] info [webmaild] 150.107.107.34 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 28 18:25:22 ait sshd[3821303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.99.79.194
description:
[2025-01-28 18:25:22 +0100] info [webmaild] 190.99.79.194 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 18:25:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
description:
2025-01-28 18:25:01 dovecot_plain authenticator failed for ([222.99.237.249]) [222.99.237.249]:46784: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.118.94
description:
Jan 28 18:25:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.118.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.118.94
description:
2025-01-28 18:25:14 dovecot_plain authenticator failed for ([211.228.118.94]) [211.228.118.94]:41395: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 28 18:25:22 ait sshd[3821303]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.99.237.249
description:
Jan 28 18:24:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.99.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.66.46
description:
[2025-01-28 18:25:52 +0100] info [webmaild] 177.39.66.46 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 18:25:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 18:26:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.213
description:
Jan 28 18:26:14 ait sshd[3821720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.213  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.153.96.146
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:18-26.54.153.96.146


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.213
description:
Jan 28 18:26:36 ait sshd[3821720]: error: maximum authentication attempts exceeded for root from 218.92.0.213 port 4968 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Jan 28 18:26:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.213
description:
Jan 28 18:26:14 ait sshd[3821720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 18:26:57 ait sshd[3822132]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 18:26:57 ait sshd[3822132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Jan 28 18:26:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-01-28 18:27:01 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:54130: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-01-28 18:26:45 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:50380: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.26.110.27
description:
[2025-01-28 18:26:47 +0100] info [webmaild] 95.26.110.27 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.44.253.46
description:
Jan 28 18:28:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.44.253.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-28 18:28:29 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:44697: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.44.253.46
description:
2025-01-28 18:28:30 dovecot_plain authenticator failed for host46.sub-63-44-253.myvzw.com [63.44.253.46]:7972: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.27.205.121
description:
[2025-01-28 18:28:36 +0100] info [webmaild] 201.27.205.121 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.154.245
description:
Jan 28 18:27:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.154.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.66.224
description:
Jan 28 18:28:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.66.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.66.224
description:
2025-01-28 18:28:16 dovecot_plain authenticator failed for ([94.204.66.224]) [94.204.66.224]:45882: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.154.245
description:
2025-01-28 18:27:52 dovecot_plain authenticator failed for ([94.202.154.245]) [94.202.154.245]:49536: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 28 18:28:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.171.89.196
description:
[2025-01-28 18:29:47 +0100] info [webmaild] 196.171.89.196 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.23.153.141
description:
[2025-01-28 18:29:55 +0100] info [webmaild] 177.23.153.141 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.107.253.40
description:
[2025-01-28 18:29:57 +0100] info [webmaild] 179.107.253.40 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
description:
Jan 28 18:30:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.241.36.223
description:
[2025-01-28 18:30:40 +0100] info [webmaild] 88.241.36.223 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.58.26
description:
[2025-01-28 18:29:49 +0100] info [webmaild] 45.70.58.26 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
description:
2025-01-28 18:30:29 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:44076: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:30:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Jan 28 18:30:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-28 18:30:38 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:44010: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 18:32:38 ait sshd[3824969]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 18:32:38 ait sshd[3824969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 28 18:31:52 ait sshd[3824655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 28 18:31:52 ait sshd[3824655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Jan 28 18:32:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 28 18:32:38 ait sshd[3824969]: Invalid user universitypublishing from 116.122.157.193 port 53516


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
description:
Jan 28 18:33:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
description:
2025-01-28 18:33:20 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:59837: 535 Incorrect authentication data (set_id=admissions@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 18:33:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Jan 28 18:33:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-01-28 18:33:27 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:54866: 535 Incorrect authentication data (set_id=admissions)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.51
description:
Jan 28 18:33:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.156.82
description:
[2025-01-28 18:33:34 +0100] info [webmaild] 45.176.156.82 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-28 18:33:10 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net (mendiums) [69.121.199.203]:38098: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Jan 28 18:33:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-01-28 18:33:13 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:40338: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.51
description:
2025-01-28 18:33:33 dovecot_plain authenticator failed for 111-70-32-51.emome-ip.hinet.net [111.70.32.51]:48751: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Jan 28 18:33:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.134.109.119
description:
2025-01-28 18:34:09 dovecot_plain authenticator failed for ([67.134.109.119]) [67.134.109.119]:42362: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 18:34:43 ait sshd[3825747]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 39416


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-28 18:33:47 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:45571: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.134.109.119
description:
Jan 28 18:34:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.134.109.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.129
description:
Jan 28 18:34:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.129
description:
2025-01-28 18:34:15 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.129]:28012: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.74.35.0
description:
[2025-01-28 18:34:29 +0100] info [webmaild] 62.74.35.0 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Jan 28 18:34:42 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 18:34:43 ait sshd[3825747]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-01-28 18:34:44 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:59742: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 28 18:33:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 18:34:43 ait sshd[3825747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.1.176.64
description:
[2025-01-28 18:35:23 +0100] info [webmaild] 181.1.176.64 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 18:34:45 ait sshd[3825747]: Failed password for invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 39416 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 18:35:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
description:
Jan 28 18:36:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.123.201.43
description:
[2025-01-28 18:36:00 +0100] info [webmaild] 181.123.201.43 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-01-28 18:36:07 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:46936: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.217.73.138
description:
2025-01-28 18:35:57 dovecot_plain authenticator failed for 200-217-73-138.host.telemar.net.br [200.217.73.138]:38850: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.217.73.138
description:
Jan 28 18:35:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.217.73.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.60.28
description:
[2025-01-28 18:35:55 +0100] info [webmaild] 131.196.60.28 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.99.23.122
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:18-36.139.99.23.122||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 18:36:47 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:42904: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.195.226.101
description:
[2025-01-28 18:37:13 +0100] info [webmaild] 45.195.226.101 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 18:36:47 ait sshd[3826681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 18:37:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 28 18:36:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 18:36:47 ait sshd[3826681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Jan 28 18:38:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 28 18:38:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
description:
Jan 28 18:38:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-28 18:38:40 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:57600: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 18:37:55 ait sshd[3827254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-01-28 18:38:27 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:51059: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.172.154
description:
[2025-01-28 18:38:40 +0100] info [webmaild] 177.125.172.154 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 18:37:55 ait sshd[3827254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.56.151.234
description:
Jan 28 18:38:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.56.151.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.151.234
description:
2025-01-28 18:38:33 dovecot_login authenticator failed for ([58.56.151.234]) [58.56.151.234]:39761: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.222.197.213
description:
[2025-01-28 18:38:08 +0100] info [webmaild] 191.222.197.213 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
description:
2025-01-28 18:38:42 dovecot_login authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:37139: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-28 18:39:23 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:46020: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 18:39:26 ait sshd[3828240]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:39:37 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 28 18:39:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
description:
Jan 28 18:39:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.157.48.252
description:
[2025-01-28 18:39:31 +0100] info [webmaild] 41.157.48.252 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
description:
2025-01-28 18:39:10 dovecot_plain authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:54402: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 18:39:26 ait sshd[3828240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-01-28 18:40:26 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:37640: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-01-28 18:40:25 dovecot_plain authenticator failed for ([41.59.228.160]) [41.59.228.160]:46726: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.208.3
description:
Jan 28 18:40:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.208.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.208.3
description:
2025-01-28 18:40:34 dovecot_plain authenticator failed for ([185.167.208.3]) [185.167.208.3]:43969: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-01-28 18:40:37 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:3632: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Jan 28 18:40:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.61.104
description:
47.128.61.104 - - [28/Jan/2025:18:39:51 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16698798 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/data/map14.php" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.61.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Jan 28 18:40:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
description:
Jan 28 18:40:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.95
description:
[2025-01-28 18:40:52 +0100] info [whostmgrd] 156.228.78.95 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.158
description:
[2025-01-28 18:40:54 +0100] info [whostmgrd] 156.228.81.158 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 28 18:41:40 ait sshd[3829427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.13
description:
[2025-01-28 18:40:49 +0100] info [cpaneld] 156.228.96.13 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.186
description:
[2025-01-28 18:40:51 +0100] info [whostmgrd] 104.207.63.186 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.51
description:
[2025-01-28 18:40:51 +0100] info [whostmgrd] 104.207.63.51 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.97
description:
[2025-01-28 18:40:50 +0100] info [whostmgrd] 104.207.32.97 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.19
description:
[2025-01-28 18:40:53 +0100] info [whostmgrd] 156.228.118.19 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.104
description:
[2025-01-28 18:40:46 +0100] info [cpaneld] 156.228.87.104 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.24
description:
[2025-01-28 18:40:49 +0100] info [cpaneld] 156.228.114.24 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 28 18:41:40 ait sshd[3829427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.81
description:
[2025-01-28 18:40:50 +0100] info [cpaneld] 104.207.39.81 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.171.34
description:
[2025-01-28 18:41:33 +0100] info [webmaild] 37.239.171.34 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.30
description:
[2025-01-28 18:40:48 +0100] info [cpaneld] 156.228.124.30 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.51.226.207
description:
Jan 28 18:41:43 ait sshd[3829427]: Failed password for invalid user elmahk from 20.51.226.207 port 54040 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.164.140.121
description:
[2025-01-28 18:41:49 +0100] info [webmaild] 160.164.140.121 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.219.209.93
description:
[2025-01-28 18:42:19 +0100] info [webmaild] 189.219.209.93 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.177.65
description:
[2025-01-28 18:42:36 +0100] info [webmaild] 177.223.177.65 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.181.142
description:
[2025-01-28 18:43:21 +0100] info [webmaild] 45.180.181.142 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.143.246.196
description:
[2025-01-28 18:42:43 +0100] info [webmaild] 190.143.246.196 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 18:43:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-45.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 28 18:46:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-28 18:46:23 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:41163: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-01-28 18:46:05 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:36366: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
description:
2025-01-28 18:46:13 dovecot_plain authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:44802: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.110.145.241
description:
[2025-01-28 18:45:49 +0100] info [webmaild] 187.110.145.241 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Jan 28 18:46:02 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-01-28 18:46:04 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:49255: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Jan 28 18:46:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 28 18:46:01 ait sshd[3831682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 28 18:46:01 ait sshd[3831682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Jan 28 18:46:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 18:48:21 ait sshd[3833039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 18:48:21 ait sshd[3833039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
description:
2025-01-28 18:47:45 dovecot_plain authenticator failed for ([182.176.150.182]) [182.176.150.182]:58735: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Jan 28 18:47:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-01-28 18:47:55 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:60582: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.254.62
description:
[2025-01-28 18:48:16 +0100] info [webmaild] 45.231.254.62 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
description:
2025-01-28 18:49:38 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:55587: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
description:
Jan 28 18:49:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
description:
2025-01-28 18:49:07 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:53996: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-01-28 18:49:26 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:54944: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 18:49:30 ait sshd[3833598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.146.48
description:
[2025-01-28 18:49:43 +0100] info [webmaild] 170.231.146.48 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Jan 28 18:49:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 18:49:30 ait sshd[3833598]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 47166


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 18:49:30 ait sshd[3833598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
description:
Jan 28 18:49:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.231
description:
Jan 28 18:49:00 ait sshd[3833290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.231
description:
Jan 28 18:49:00 ait sshd[3833290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 18:49:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 28 18:49:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-28 18:50:01 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:41206: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.226.154.186
description:
[2025-01-28 18:50:20 +0100] info [webmaild] 91.226.154.186 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:51:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 18:51:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.214.125
description:
[2025-01-28 18:51:25 +0100] info [webmaild] 177.137.214.125 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 18:51:25 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:42042: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 18:50:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.242.204.22
description:
Jan 28 18:51:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.242.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.242.204.22
description:
2025-01-28 18:51:50 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:3574: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-28 18:51:52 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:54953: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.158.187.151
description:
[2025-01-28 18:51:58 +0100] info [webmaild] 178.158.187.151 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Jan 28 18:52:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-01-28 18:52:09 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:47644: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 28 18:51:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:51:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.169.248.82
description:
Jan 28 18:52:02 ait sshd[3835012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.169.248.82


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.194.235.201
description:
Jan 28 18:52:17 ait sshd[3835124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.194.235.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.194.235.201
description:
Jan 28 18:52:17 ait sshd[3835124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.194.235.201


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.9.110
description:
Jan 28 18:52:45 ait sshd[3835276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.9.110


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.42.138
description:
[2025-01-28 18:53:03 +0100] info [webmaild] 157.100.42.138 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.9.110
description:
Jan 28 18:52:45 ait sshd[3835276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.9.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 18:53:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.252.167.86
description:
[2025-01-28 18:53:59 +0100] info [webmaild] 212.252.167.86 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.127.151
description:
[2025-01-28 18:54:42 +0100] info [webmaild] 170.0.127.151 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.194.235.201
description:
Jan 28 18:54:50 ait sshd[3836418]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.194.235.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.58.213.65
description:
[2025-01-28 18:54:59 +0100] info [webmaild] 179.58.213.65 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.55.183
description:
47.128.55.183 - - [28/Jan/2025:18:55:25 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17193891 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C183%2C79%2C198" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.55.183


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.123.3.116
description:
[2025-01-28 18:55:43 +0100] info [webmaild] 187.123.3.116 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 18:55:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 28 18:55:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.194.235.201
description:
Jan 28 18:54:50 ait sshd[3836418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.194.235.201


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 28 18:55:03 ait sshd[3836707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 28 18:55:03 ait sshd[3836707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.15.214.58
description:
[2025-01-28 18:55:05 +0100] info [webmaild] 176.15.214.58 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
description:
2025-01-28 18:56:13 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:41943: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.235.201
description:
Jan 28 18:56:17 ait sshd[3837228]: Failed password for invalid user orati from 118.194.235.201 port 59090 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.169.248.82
description:
Jan 28 18:55:45 ait sshd[3837012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.169.248.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
description:
Jan 28 18:56:11 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.194.235.201
description:
Jan 28 18:56:15 ait sshd[3837228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.194.235.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.194.235.201
description:
Jan 28 18:56:15 ait sshd[3837228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.194.235.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-01-28 18:55:45 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:50732: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 28 18:56:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-01-28 18:57:07 dovecot_login authenticator failed for ([111.48.214.96]) [111.48.214.96]:34308: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.9.110
description:
Jan 28 18:57:11 ait sshd[3837750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.9.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 28 18:57:17 ait sshd[3837785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Jan 28 18:56:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.169.248.82
description:
Jan 28 18:57:03 ait sshd[3837675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.169.248.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Jan 28 18:57:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.9.110
description:
Jan 28 18:57:11 ait sshd[3837750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.9.110


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 221.156.137.103
description:
Jan 28 18:57:17 ait sshd[3837785]: Invalid user universitypublishing from 221.156.137.103 port 55118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-28 18:56:58 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:50222: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 18:56:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
description:
Jan 28 18:57:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-01-28 18:56:50 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:39020: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 28 18:57:17 ait sshd[3837785]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
description:
2025-01-28 18:57:21 dovecot_login authenticator failed for ([39.155.191.166]) [39.155.191.166]:39526: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-28 18:58:06 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:53939: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.79.138.248
description:
[2025-01-28 18:58:06 +0100] info [webmaild] 201.79.138.248 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 28 18:58:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Jan 28 18:58:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 28 18:58:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-01-28 18:58:40 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:54486: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Jan 28 18:57:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-28 18:57:58 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:43468: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-28 18:58:28 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:32929: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 18:58:34 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Jan 28 18:58:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.203.182.247
description:
[2025-01-28 18:59:00 +0100] info [webmaild] 189.203.182.247 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-01-28 18:58:45 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:38202: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 28 18:58:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-28 18:58:56 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:51684: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 19:00:36 ait sshd[3839853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 67.209.135.146
description:
[2025-01-28 19:00:36 +0100] info [webmaild] 67.209.135.146 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 19:00:35 ait sshd[3839853]: Invalid user h1-lubricants.net 2a00 from 122.51.104.242 port 55886


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 19:00:36 ait sshd[3839853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.81.212.144
description:
[2025-01-28 18:59:51 +0100] info [webmaild] 41.81.212.144 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.201.51
description:
[2025-01-28 18:59:55 +0100] info [webmaild] 45.5.201.51 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-01-28 19:01:40 dovecot_plain authenticator failed for (brians) [62.182.116.64]:52807: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.173.131
description:
Jan 28 19:00:56 ait sshd[3839967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.173.131


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 28 19:00:48 ait sshd[3839926]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.173.131
description:
Jan 28 19:00:56 ait sshd[3839967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.173.131 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 28 19:00:48 ait sshd[3839926]: Invalid user h1-lubricants.net 2a00 from 122.51.104.242 port 60530


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 28 19:00:48 ait sshd[3839926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Jan 28 19:01:38 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.41.48
description:
[2025-01-28 19:02:07 +0100] info [webmaild] 158.181.41.48 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 19:03:30 ait sshd[3841513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 28 19:02:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 28 19:03:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-28 19:03:23 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:52555: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.191.136.158
description:
[2025-01-28 19:02:43 +0100] info [webmaild] 45.191.136.158 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-28 19:02:56 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:58082: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.229.9.110
description:
Jan 28 19:03:44 ait sshd[3841564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.9.110  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:04:18 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.229.9.110
description:
Jan 28 19:03:44 ait sshd[3841564]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.229.9.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-28 19:03:47 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:50920: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 19:04:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.241.255
description:
[2025-01-28 19:04:01 +0100] info [webmaild] 45.236.241.255 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.248.46
description:
[2025-01-28 19:04:31 +0100] info [webmaild] 186.68.248.46 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
description:
Jan 28 19:05:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-01-28 19:04:56 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:56080: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.38.162.158
description:
[2025-01-28 19:04:53 +0100] info [webmaild] 179.38.162.158 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.115.104.38
description:
Jan 28 19:05:16 ait sshd[3842699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.115.104.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.104.38
description:
Jan 28 19:05:16 ait sshd[3842699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.115.104.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-01-28 19:05:22 dovecot_plain authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:48878: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Jan 28 19:04:54 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.108
description:
Jan 28 19:06:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.108
description:
2025-01-28 19:06:08 dovecot_plain authenticator failed for 111-70-3-108.emome-ip.hinet.net [111.70.3.108]:49521: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 19:05:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.204.22
description:
Jan 28 19:06:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.245
description:
Jan 28 19:06:16 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Jan 28 19:05:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.245
description:
2025-01-28 19:06:18 dovecot_plain authenticator failed for 111-70-23-245.emome-ip.hinet.net [111.70.23.245]:47779: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.204.22
description:
2025-01-28 19:06:28 dovecot_plain authenticator failed for ([196.46.204.22]) [196.46.204.22]:38701: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.120.166.51
description:
[2025-01-28 19:06:32 +0100] info [webmaild] 103.120.166.51 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
description:
Jan 28 19:06:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
description:
2025-01-28 19:06:03 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:45856: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Jan 28 19:06:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-01-28 19:05:53 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:53740: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-01-28 19:06:21 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:35539: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-01-28 19:07:03 dovecot_plain authenticator failed for ([175.156.80.166]) [175.156.80.166]:35841: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
description:
Jan 28 19:07:39 ait sshd[3843916]: Invalid user universitypublishing from 211.108.234.111 port 43880


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.191.170.208
description:
Jan 28 19:06:56 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.191.170.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.191.170.208
description:
2025-01-28 19:06:58 dovecot_login authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:38462: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
description:
Jan 28 19:07:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Jan 28 19:07:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 28 19:07:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 28 19:07:39 ait sshd[3843916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
description:
Jan 28 19:06:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Jan 28 19:07:41 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-01-28 19:07:08 dovecot_login authenticator failed for ([47.149.190.181]) [47.149.190.181]:49188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.133.170
description:
[2025-01-28 19:07:24 +0100] info [webmaild] 37.239.133.170 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.75.226.140
description:
[2025-01-28 19:07:33 +0100] info [webmaild] 177.75.226.140 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 28 19:07:39 ait sshd[3843916]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 19:07:42 +0100] info [webmaild] 217.160.25.51 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-01-28 19:06:47 dovecot_plain authenticator failed for ([187.161.226.88]) [187.161.226.88]:51759: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-28 19:07:30 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:19632: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:07:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-01-28 19:07:43 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:61680: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.18.96.126
description:
[2025-01-28 19:07:54 +0100] info [webmaild] 37.18.96.126 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.227.64.254
description:
[2025-01-28 19:08:15 +0100] info [webmaild] 41.227.64.254 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Jan 28 19:07:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 19:08:23 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.134.146
description:
Jan 28 19:08:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.134.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.162
description:
[2025-01-28 19:09:30 +0100] info [cpaneld] 104.207.59.162 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.156
description:
[2025-01-28 19:09:33 +0100] info [whostmgrd] 156.228.83.156 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.89
description:
[2025-01-28 19:09:29 +0100] info [cpaneld] 104.207.49.89 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng20b00215y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.208
description:
[2025-01-28 19:09:31 +0100] info [cpaneld] 156.228.91.208 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.62.232
description:
[2025-01-28 19:09:33 +0100] info [whostmgrd] 104.207.62.232 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.235
description:
[2025-01-28 19:09:34 +0100] info [whostmgrd] 156.228.98.235 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 19:09:42 ait sshd[3845142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 19:09:42 ait sshd[3845142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:08:52 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Jan 28 19:09:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-28 19:08:57 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:55971: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.113
description:
[2025-01-28 19:09:35 +0100] info [whostmgrd] 156.228.85.113 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-28 19:09:42 dovecot_login authenticator failed for ([180.69.30.93]) [180.69.30.93]:51650: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 28 19:08:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.95
description:
[2025-01-28 19:09:31 +0100] info [cpaneld] 104.207.52.95 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng20b00215y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.31
description:
[2025-01-28 19:09:32 +0100] info [whostmgrd] 104.207.36.31 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.22
description:
[2025-01-28 19:09:32 +0100] info [cpaneld] 104.207.57.22 - eng20b00215y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng20b00215y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-28 19:09:34 dovecot_login authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:36837: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
description:
2025-01-28 19:08:47 dovecot_login authenticator failed for ([36.154.134.146]) [36.154.134.146]:34332: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 28 19:09:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.182
description:
[2025-01-28 19:09:34 +0100] info [whostmgrd] 156.228.90.182 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
description:
2025-01-28 19:10:33 dovecot_login authenticator failed for ([124.112.45.222]) [124.112.45.222]:38329: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-28 19:10:35 dovecot_login authenticator failed for ([1.245.207.104]) [1.245.207.104]:38869: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.160
description:
Jan 28 19:10:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.211.41
description:
[2025-01-28 19:10:26 +0100] info [webmaild] 45.175.211.41 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
description:
Jan 28 19:09:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Jan 28 19:10:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
description:
2025-01-28 19:10:42 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:43932: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Jan 28 19:10:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 19:09:47 ait sshd[3845187]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 57736


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
description:
2025-01-28 19:10:06 dovecot_login authenticator failed for ([121.167.217.147]) [121.167.217.147]:56304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
description:
Jan 28 19:10:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-28 19:09:52 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:53265: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.114.191.28
description:
[2025-01-28 19:10:11 +0100] info [webmaild] 181.114.191.28 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 19:10:16 ait sshd[3845668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Jan 28 19:10:20 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.147.125.200
description:
Jan 28 19:09:44 ait sshd[3845142]: Failed password for invalid user michael from 185.147.125.200 port 28623 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 19:09:47 ait sshd[3845187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-01-28 19:10:00 dovecot_login authenticator failed for ([110.35.63.30]) [110.35.63.30]:56790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-01-28 19:10:22 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:35542: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-01-28 19:10:41 dovecot_login authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:55362: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 19:09:47 ait sshd[3845187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 19:10:16 ait sshd[3845668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-01-28 19:10:21 dovecot_login authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:63112: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 28 19:10:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
description:
Jan 28 19:10:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Jan 28 19:09:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-01-28 19:09:45 dovecot_login authenticator failed for ([1.183.1.82]) [1.183.1.82]:39965: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Jan 28 19:09:50 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Jan 28 19:11:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-01-28 19:11:03 dovecot_login authenticator failed for ([114.221.2.199]) [114.221.2.199]:54316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Jan 28 19:11:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-01-28 19:11:09 dovecot_login authenticator failed for ([121.202.152.120]) [121.202.152.120]:50205: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 28 19:12:03 ait sshd[3846663]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.194.191
description:
Jan 28 19:12:11 ait sshd[3846781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.30.194.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.58
description:
[2025-01-28 19:12:27 +0100] info [webmaild] 84.54.72.58 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 19:11:50 ait sshd[3846576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 19:11:50 ait sshd[3846576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 28 19:12:03 ait sshd[3846663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.30.194.191
description:
Jan 28 19:12:11 ait sshd[3846781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.30.194.191


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.220.39.38
description:
[2025-01-28 19:12:14 +0100] info [webmaild] 186.220.39.38 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
description:
2025-01-28 19:12:38 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:63391: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
description:
Jan 28 19:12:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 19:12:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 28 19:12:43 ait sshd[3847048]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.3.79
description:
Jan 28 19:12:54 ait sshd[3847131]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.3.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:13:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.3.79
description:
Jan 28 19:12:54 ait sshd[3847131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.3.79


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 28 19:12:43 ait sshd[3847048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Jan 28 19:12:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-01-28 19:12:50 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:36732: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.143.23
description:
[2025-01-28 19:13:10 +0100] info [webmaild] 45.184.143.23 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.49.64
description:
47.128.49.64 - - [28/Jan/2025:19:13:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23191336 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?filter_course-language=95%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.49.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 28 19:14:24 ait sshd[3847922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.235.68.52
description:
Jan 28 19:14:09 ait sshd[3847700]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.235.68.52 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.235.68.52
description:
Jan 28 19:14:09 ait sshd[3847700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.235.68.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.115.161.177
description:
[2025-01-28 19:14:21 +0100] info [webmaild] 196.115.161.177 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Jan 28 19:14:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-01-28 19:14:17 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:46148: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.142
description:
Jan 28 19:14:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 28 19:14:24 ait sshd[3847922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
description:
2025-01-28 19:14:27 dovecot_plain authenticator failed for ([116.113.253.142]) [116.113.253.142]:44611: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
description:
Jan 28 19:15:09 ait sshd[3848523]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.203
description:
Jan 28 19:15:27 ait sshd[3848523]: error: maximum authentication attempts exceeded for root from 218.92.0.203 port 31058 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 28 19:15:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
description:
Jan 28 19:15:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 28 19:14:49 ait sshd[3848278]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.61.58
description:
47.128.61.58 - - [28/Jan/2025:19:15:40 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16505679 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?filter_course-language=120%2C198&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.61.58


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-28 19:15:32 dovecot_plain authenticator failed for ([82.193.122.91]) [82.193.122.91]:40693: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.25.209
description:
Jan 28 19:15:13 ait sshd[3848534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.163.25.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 28 19:14:49 ait sshd[3848278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.203
description:
Jan 28 19:15:09 ait sshd[3848523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Jan 28 19:15:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-01-28 19:15:37 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:45570: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-01-28 19:15:26 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:51588: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.163.25.209
description:
Jan 28 19:15:13 ait sshd[3848534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.25.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.245.199
description:
[2025-01-28 19:15:15 +0100] info [webmaild] 201.49.245.199 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-28 19:15:55 dovecot_plain authenticator failed for (duawenes) [178.250.191.189]:53428: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.170.94
description:
Jan 28 19:16:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.170.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.205
description:
Jan 28 19:16:39 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.224.106.47
description:
Jan 28 19:15:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.224.106.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 28 19:15:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.205
description:
2025-01-28 19:16:41 dovecot_plain authenticator failed for ([58.229.51.205]) [58.229.51.205]:52310: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.3.79
description:
Jan 28 19:16:40 ait sshd[3849347]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.3.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.51.158
description:
2025-01-28 19:16:21 dovecot_login authenticator failed for ([189.31.51.158]) [189.31.51.158]:42225: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.143.234.101
description:
[2025-01-28 19:16:35 +0100] info [webmaild] 103.143.234.101 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.224.106.47
description:
2025-01-28 19:15:45 dovecot_plain authenticator failed for ([117.72.66.209]) [27.224.106.47]:15981: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.3.79
description:
Jan 28 19:16:40 ait sshd[3849347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.3.79


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Jan 28 19:16:13 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.31.51.158
description:
Jan 28 19:16:19 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.31.51.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.170.94
description:
2025-01-28 19:16:32 dovecot_login authenticator failed for (94.170.89.103.dynamic.dreamlink.in) [103.89.170.94]:58704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.159.8
description:
[2025-01-28 19:15:51 +0100] info [webmaild] 177.39.159.8 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.34.130
description:
47.128.34.130 - - [28/Jan/2025:19:15:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21827353 HTTP/2.0" 302 0 ait-open.net "https://ait-open.net/elearning/course/info.php?id=860" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.34.130


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.225.3.79
description:
Jan 28 19:16:44 ait sshd[3849347]: Disconnected from invalid user ubuntu 14.225.3.79 port 47980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.39.166
description:
2025-01-28 19:17:33 dovecot_login authenticator failed for ([60.28.39.166]) [60.28.39.166]:34494: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.194.191
description:
Jan 28 19:17:13 ait sshd[3849567]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.30.194.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
description:
2025-01-28 19:16:50 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:48135: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
description:
2025-01-28 19:16:59 dovecot_login authenticator failed for ([46.29.121.110]) [46.29.121.110]:38736: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Jan 28 19:16:46 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-01-28 19:16:48 dovecot_plain authenticator failed for (redimencor) [65.20.128.78]:49470: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
description:
Jan 28 19:16:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.39.166
description:
Jan 28 19:17:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.39.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
description:
Jan 28 19:16:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
description:
Jan 28 19:16:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
description:
2025-01-28 19:16:55 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:58062: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.30.194.191
description:
Jan 28 19:17:13 ait sshd[3849567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.30.194.191


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.114.199.23
description:
[2025-01-28 19:17:01 +0100] info [webmaild] 41.114.199.23 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.223
description:
Jan 28 19:18:22 ait sshd[3850321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.223  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.225.3.79
description:
Jan 28 19:18:25 ait sshd[3850330]: Failed password for invalid user test from 14.225.3.79 port 46656 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.223
description:
Jan 28 19:18:22 ait sshd[3850321]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-28 19:17:46 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:60022: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-18.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.3.79
description:
Jan 28 19:18:22 ait sshd[3850330]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.3.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 28 19:17:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.3.79
description:
Jan 28 19:18:22 ait sshd[3850330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.3.79


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 28 19:18:56 ait sshd[3850493]: Invalid user youngartistspublished.com 2a01 from 111.231.56.128 port 43296


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.128.137.31
description:
[2025-01-28 19:18:55 +0100] info [webmaild] 186.128.137.31 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:19:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.223
description:
Jan 28 19:19:07 ait sshd[3850528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.235.68.52
description:
Jan 28 19:19:12 ait sshd[3850616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.235.68.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.194.191
description:
Jan 28 19:19:13 ait sshd[3850620]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.30.194.191 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.30.194.191
description:
Jan 28 19:19:13 ait sshd[3850620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.30.194.191


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.235.68.52
description:
Jan 28 19:19:12 ait sshd[3850616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.235.68.52


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 28 19:18:56 ait sshd[3850493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 28 19:18:56 ait sshd[3850493]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.223
description:
Jan 28 19:19:07 ait sshd[3850528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.223  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.136.194.13
description:
[2025-01-28 19:19:40 +0100] info [webmaild] 177.136.194.13 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 19:20:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (eproly) [87.103.126.54]:51641: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-28 19:20:26 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (pring) [91.56.31.167]:62568: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.104.178
description:
[2025-01-28 19:19:50 +0100] info [webmaild] 170.82.104.178 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 19:20:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.34.84
description:
Jan 28 19:20:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.25.209
description:
Jan 28 19:20:05 ait sshd[3851259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.163.25.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 19:19:46 dovecot_plain authenticator failed for (clatelato) [81.211.77.58]:39087: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.43.249
description:
[2025-01-28 19:20:36 +0100] info [webmaild] 177.73.43.249 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.235.68.52
description:
Jan 28 19:20:33 ait sshd[3851605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.235.68.52


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 28 19:20:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 19:19:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.4.144.86
description:
2025-01-28 19:20:33 dovecot_plain authenticator failed for ([103.4.144.86]) [103.4.144.86]:52741: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.4.144.86
description:
Jan 28 19:20:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.4.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.54.69
description:
[2025-01-28 19:20:29 +0100] info [webmaild] 181.199.54.69 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.235.68.52
description:
Jan 28 19:20:33 ait sshd[3851605]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.235.68.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
description:
2025-01-28 19:20:42 dovecot_plain authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:54438: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.163.25.209
description:
Jan 28 19:20:05 ait sshd[3851259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.25.209


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.25.209
description:
Jan 28 19:21:40 ait sshd[3851997]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.163.25.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.139.226.70
description:
[2025-01-28 19:21:34 +0100] info [webmaild] 5.139.226.70 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.163.25.209
description:
Jan 28 19:21:40 ait sshd[3851997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.25.209


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-28 19:22:26 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:53615: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.54.82
description:
[2025-01-28 19:22:35 +0100] info [webmaild] 138.0.54.82 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 19:22:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.146.4
description:
2025-01-28 19:22:09 dovecot_plain authenticator failed for (cenostle) [37.99.146.4]:53035: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
description:
2025-01-28 19:22:02 dovecot_plain authenticator failed for (ovendal) [65.20.204.164]:57627: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Jan 28 19:22:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 28 19:22:24 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.164
description:
Jan 28 19:22:00 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 19:22:06 dovecot_plain authenticator failed for (bionmook) [81.211.77.58]:53356: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.99.146.4
description:
Jan 28 19:22:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.99.146.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-28 19:22:16 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:49366: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-28 19:23:03 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:51840: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 28 19:23:40 ait sshd[3852895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-01-28 19:22:49 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:48333: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 28 19:23:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 28 19:23:40 ait sshd[3852895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Jan 28 19:22:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.6.55.57
description:
Jan 28 19:24:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.6.55.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.235.182.148
description:
[2025-01-28 19:24:25 +0100] info [webmaild] 176.235.182.148 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
description:
2025-01-28 19:24:35 dovecot_plain authenticator failed for ([119.6.55.57]) [119.6.55.57]:40530: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-28 19:24:49 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:46088: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.178.55.68
description:
[2025-01-28 19:25:02 +0100] info [webmaild] 160.178.55.68 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.120.4.117
description:
[2025-01-28 19:25:20 +0100] info [webmaild] 178.120.4.117 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 28 19:24:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 28 19:24:57 ait sshd[3853781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 28 19:24:57 ait sshd[3853781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 28 19:26:01 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-01-28 19:26:14 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:47365: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 19:25:53 ait sshd[3854476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Jan 28 19:26:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
description:
Jan 28 19:26:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.205.17.22
description:
[2025-01-28 19:26:40 +0100] info [webmaild] 186.205.17.22 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 19:25:53 ait sshd[3854476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.17.16
description:
Jan 28 19:26:03 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.17.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
description:
Jan 28 19:26:40 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-01-28 19:26:42 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:51576: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.17.16
description:
2025-01-28 19:26:05 dovecot_plain authenticator failed for ([223.84.17.16]) [223.84.17.16]:1035: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 28 19:26:41 ait sshd[3854007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-28 19:26:03 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:45221: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-01-28 19:26:17 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:40286: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 28 19:26:41 ait sshd[3854007]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
description:
Jan 28 19:26:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
description:
2025-01-28 19:27:34 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:53281: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-01-28 19:27:29 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:47080: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
description:
Jan 28 19:27:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Jan 28 19:27:27 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.101.164
description:
[2025-01-28 19:27:28 +0100] info [webmaild] 138.219.101.164 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
description:
2025-01-28 19:26:57 dovecot_plain authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:54068: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.78
description:
Jan 28 19:27:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.78
description:
2025-01-28 19:27:31 dovecot_login authenticator failed for ([122.187.246.78]) [122.187.246.78]:42918: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
description:
Jan 28 19:27:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.111.23.53
description:
[2025-01-28 19:27:07 +0100] info [webmaild] 179.111.23.53 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 28 19:27:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-28 19:27:49 dovecot_login authenticator failed for ([120.71.199.46]) [120.71.199.46]:35938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-01-28 19:27:49 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:36800: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 19:28:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Jan 28 19:27:47 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-28 19:27:57 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:38872: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.154.199.12
description:
Jan 28 19:27:59 ait sshd[3855524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.199.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
description:
2025-01-28 19:28:19 dovecot_login authenticator failed for ([195.158.19.6]) [195.158.19.6]:52772: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.204.106
description:
Jan 28 19:28:28 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.204.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 28 19:28:42 ait sshd[3855806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
description:
2025-01-28 19:27:45 dovecot_login authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:44450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.154.199.12
description:
Jan 28 19:27:59 ait sshd[3855524]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.154.199.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
description:
Jan 28 19:28:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
description:
Jan 28 19:28:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
description:
2025-01-28 19:28:17 dovecot_plain authenticator failed for ([219.144.16.16]) [219.144.16.16]:59447: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Jan 28 19:28:43 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 28 19:28:42 ait sshd[3855806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 28 19:27:55 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-01-28 19:28:01 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:35576: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.235
description:
Jan 28 19:28:07 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.235
description:
2025-01-28 19:28:09 dovecot_plain authenticator failed for 110-25-105-235.adsl.fetnet.net [110.25.105.235]:40868: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.106
description:
2025-01-28 19:28:30 dovecot_login authenticator failed for ([125.23.204.106]) [125.23.204.106]:42332: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Jan 28 19:27:59 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-01-28 19:28:45 dovecot_login authenticator failed for ([183.230.252.103]) [183.230.252.103]:58058: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.18.221.64
description:
[2025-01-28 19:29:13 +0100] info [webmaild] 189.18.221.64 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 28 19:28:53 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-28 19:28:55 dovecot_login authenticator failed for ([188.226.47.211]) [188.226.47.211]:53764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.171.124
description:
[2025-01-28 19:29:27 +0100] info [webmaild] 45.236.171.124 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.68
description:
[2025-01-28 19:30:27 +0100] info [whostmgrd] 154.214.1.68 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 28 19:30:35 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.150
description:
[2025-01-28 19:30:21 +0100] info [cpaneld] 104.207.41.150 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.115
description:
[2025-01-28 19:30:22 +0100] info [cpaneld] 156.228.109.115 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.62
description:
[2025-01-28 19:30:22 +0100] info [cpaneld] 104.207.52.62 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.14
description:
[2025-01-28 19:30:25 +0100] info [whostmgrd] 104.207.61.14 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.137
description:
[2025-01-28 19:30:28 +0100] info [whostmgrd] 104.207.57.137 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.37.68
description:
[2025-01-28 19:30:29 +0100] info [whostmgrd] 104.207.37.68 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-28 19:30:37 dovecot_plain authenticator failed for (inearrock) [94.140.210.134]:42841: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.38
description:
[2025-01-28 19:30:21 +0100] info [cpaneld] 156.228.93.38 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.207
description:
[2025-01-28 19:30:23 +0100] info [cpaneld] 104.207.40.207 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ADS20B00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.83
description:
[2025-01-28 19:30:23 +0100] info [whostmgrd] 104.207.45.83 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.66
description:
[2025-01-28 19:30:29 +0100] info [whostmgrd] 104.207.42.66 - ADS20B00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
description:
2025-01-28 19:31:10 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:60046: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-28 19:30:53 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:47993: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.175.181.227
description:
[2025-01-28 19:31:12 +0100] info [webmaild] 212.175.181.227 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.173.173.60
description:
Jan 28 19:30:45 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.173.173.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.173.173.60
description:
2025-01-28 19:30:47 dovecot_plain authenticator failed for (fratochoid) [178.173.173.60]:51551: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 28 19:30:51 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
description:
Jan 28 19:31:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.48.182
description:
47.128.48.182 - - [28/Jan/2025:19:32:07 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16579397" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.48.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.137.249
description:
[2025-01-28 19:32:18 +0100] info [webmaild] 177.91.137.249 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 19:32:25 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 28 19:32:17 ait sshd[3858290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 19:32:27 dovecot_plain authenticator failed for (exprocily) [81.211.77.58]:11688: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.88
description:
47.128.96.88 - - [28/Jan/2025:19:31:52 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4723733 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/mod/forum/discuss.php?d=8317" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.161.105
description:
[2025-01-28 19:31:55 +0100] info [webmaild] 45.226.161.105 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 28 19:32:17 ait sshd[3858290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.178.212
description:
[2025-01-28 19:32:48 +0100] info [webmaild] 45.165.178.212 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 28 19:33:08 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-28 19:33:10 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (micannut) [109.164.246.53]:39138: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.126.65.135
description:
Jan 28 19:33:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.126.65.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.135
description:
2025-01-28 19:33:28 dovecot_plain authenticator failed for ([216.126.65.135]) [216.126.65.135]:59967: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.111.148.191
description:
[2025-01-28 19:32:49 +0100] info [webmaild] 105.111.148.191 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 36.37.169.234
description:
[2025-01-28 19:33:05 +0100] info [webmaild] 36.37.169.234 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Jan 28 19:33:57 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 28 19:34:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-01-28 19:33:59 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:3717: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-01-28 19:34:07 dovecot_plain authenticator failed for ([112.194.143.206]) [112.194.143.206]:51244: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 28 19:34:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-28 19:34:17 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:45448: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:34:21 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-28 19:34:51 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:61263: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
description:
Jan 28 19:34:58 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
description:
2025-01-28 19:35:00 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:36596: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 28 19:34:49 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 19:35:30 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-28 19:35:11 +0100] info [cpaneld] 217.160.25.51 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.215.190
description:
[2025-01-28 19:34:44 +0100] info [webmaild] 45.234.215.190 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
description:
2025-01-28 19:36:06 dovecot_plain authenticator failed for ([191.36.156.14]) [191.36.156.14]:33415: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 28 19:36:23 ait sshd[3861071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 28 19:36:11 ait sshd[3860964]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.173.41.125
description:
[2025-01-28 19:36:33 +0100] info [webmaild] 78.173.41.125 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.129
description:
2025-01-28 19:36:19 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.129]:3293: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 28 19:36:11 ait sshd[3860964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.129
description:
Jan 28 19:36:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 28 19:36:23 ait sshd[3861071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
description:
Jan 28 19:36:04 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.242.69.155
description:
[2025-01-28 19:38:39 +0100] info [webmaild] 88.242.69.155 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.170.33.85
description:
[2025-01-28 19:37:52 +0100] info [webmaild] 41.170.33.85 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.98.42.218
description:
[2025-01-28 19:37:58 +0100] info [webmaild] 177.98.42.218 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 19:38:32 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-01-28 19:39:14 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:39940: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
description:
Jan 28 19:39:17 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-01-28 19:39:19 dovecot_login authenticator failed for ([104.236.145.128]) [104.236.145.128]:47220: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
description:
Jan 28 19:39:29 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
description:
2025-01-28 19:39:35 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:63709: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.251.108.124
description:
Jan 28 19:39:33 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.251.108.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
description:
Jan 28 19:39:36 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.155.16.231
description:
2025-01-28 19:39:33 dovecot_login authenticator failed for ([121.155.16.231]) [121.155.16.231]:45980: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Jan 28 19:39:14 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
description:
2025-01-28 19:39:38 dovecot_login authenticator failed for ([31.220.168.116]) [31.220.168.116]:41584: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.246.139
description:
[2025-01-28 19:39:05 +0100] info [webmaild] 201.49.246.139 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-28 19:39:07 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:43474: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-01-28 19:39:16 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:58431: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 28 19:39:26 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-28 19:39:28 dovecot_login authenticator failed for ([159.89.232.138]) [159.89.232.138]:31546: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
description:
2025-01-28 19:39:31 dovecot_login authenticator failed for ([111.48.214.102]) [111.48.214.102]:45002: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Jan 28 19:39:12 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.21
description:
2025-01-28 19:39:17 dovecot_login authenticator failed for s142-59-214-21.ab.hsia.telus.net [142.59.214.21]:51766: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.155.16.231
description:
Jan 28 19:39:31 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.155.16.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 28 19:39:05 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.252.18.246
description:
2025-01-28 19:39:08 dovecot_login authenticator failed for ([162.252.18.246]) [162.252.18.246]:60836: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.252.18.246
description:
Jan 28 19:39:06 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.252.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.21
description:
Jan 28 19:39:15 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.239.191.211
description:
Jan 28 19:39:44 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.239.191.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
description:
Jan 28 19:39:48 ait auth[3601713]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


