# incident

plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.227
country_id: 1814991
description:
Feb  7 12:14:56 ait sshd[1774753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.227  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
country_id: 6252001
description:
Feb  7 12:15:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-02-07 12:16:08 dovecot_plain authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:51330: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.52.106
country_id: 1814991
description:
2025-02-07 12:15:48 dovecot_plain authenticator failed for ([218.22.52.106]) [218.22.52.106]:51829: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
country_id: 1605651
description:
Feb  7 12:16:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-02-07 12:16:02 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:41414: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
country_id: 6252001
description:
Feb  7 12:16:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.52.106
country_id: 1814991
description:
Feb  7 12:15:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.52.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.42.133.74
country_id: 1835841
description:
Feb  7 12:16:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.42.133.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.42.133.74
country_id: 1835841
description:
2025-02-07 12:16:16 dovecot_plain authenticator failed for ([61.42.133.74]) [61.42.133.74]:50329: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
country_id: 3469034
description:
2025-02-07 12:17:18 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:46875: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.162.79.39
country_id: 1814991
description:
Feb  7 12:16:39 ait sshd[1775638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.162.79.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
country_id: 1814991
description:
Feb  7 12:16:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
country_id: 1814991
description:
2025-02-07 12:16:59 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:43456: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
country_id: 3469034
description:
Feb  7 12:17:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.162.79.39
country_id: 1814991
description:
Feb  7 12:16:39 ait sshd[1775638]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.162.79.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
country_id: 2017370
description:
Feb  7 12:18:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
country_id: 2017370
description:
2025-02-07 12:18:02 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:54837: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  7 12:18:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
country_id: 1880251
description:
Feb  7 12:18:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
country_id: 1880251
description:
2025-02-07 12:18:20 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:49695: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-07 12:18:11 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (nonverthic) [80.14.31.158]:45833: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.50.177.48
country_id: 1562822
description:
Feb  7 12:19:18 ait sshd[1776934]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.50.177.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 12:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-07 12:19:27 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:56547: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.149.125.227
country_id: 2328926
description:
Feb  7 12:19:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.149.125.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
country_id: 290557
description:
Feb  7 12:19:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
country_id: 290557
description:
2025-02-07 12:19:05 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:49309: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.179.58
country_id: 1814991
description:
Feb  7 12:19:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.179.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.179.58
country_id: 1814991
description:
2025-02-07 12:19:14 dovecot_plain authenticator failed for ([122.224.179.58]) [122.224.179.58]:38040: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
country_id: 1814991
description:
2025-02-07 12:18:51 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:37534: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.149.125.227
country_id: 2328926
description:
2025-02-07 12:19:03 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:60908: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.50.177.48
country_id: 1562822
description:
Feb  7 12:19:18 ait sshd[1776934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.50.177.48


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  7 12:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 12:18:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
country_id: 1814991
description:
Feb  7 12:18:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.220.91.130
country_id: 1269750
description:
Feb  7 12:20:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.220.91.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.188.200
country_id: 3469034
description:
[2025-02-07 12:20:10 +0100] info [webmaild] 186.235.188.200 - info@lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
country_id: 2077456
description:
Feb  7 12:19:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
country_id: 2077456
description:
2025-02-07 12:19:29 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:39978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  7 12:20:40 ait sshd[1777496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.19.211.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.131.172.138
country_id: 1814991
description:
Feb  7 12:20:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.131.172.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 12:21:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  7 12:21:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-07 12:21:06 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:43908: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
country_id: 2542007
description:
Feb  7 12:21:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  7 12:20:40 ait sshd[1777496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.19.211.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.119.194
country_id: 1814991
description:
2025-02-07 12:20:49 dovecot_plain authenticator failed for ([113.57.119.194]) [113.57.119.194]:17046: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
country_id: 1814991
description:
2025-02-07 12:21:08 dovecot_plain authenticator failed for ([111.207.231.67]) [111.207.231.65]:30783: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.131.172.138
country_id: 1814991
description:
2025-02-07 12:20:45 dovecot_plain authenticator failed for ([219.131.172.138]) [219.131.172.138]:50209: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.119.194
country_id: 1814991
description:
Feb  7 12:20:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
country_id: 1814991
description:
Feb  7 12:21:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-02-07 12:21:23 dovecot_plain authenticator failed for (sping) [154.144.243.93]:57572: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
country_id: 99237
description:
Feb  7 12:22:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
country_id: 99237
description:
2025-02-07 12:22:18 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:34038: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-21.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  7 12:22:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-07 12:22:05 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:45996: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
country_id: 1814991
description:
Feb  7 12:22:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
country_id: 1814991
description:
2025-02-07 12:22:15 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:52966: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
country_id: 1269750
description:
2025-02-07 12:23:21 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:50204: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-02-07 12:23:26 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:56998: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-02-07 12:22:32 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:53098: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
country_id: 1562822
description:
2025-02-07 12:22:52 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:25452: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
country_id: 1269750
description:
Feb  7 12:23:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
country_id: 6252001
description:
2025-02-07 12:23:03 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:59306: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
country_id: 2017370
description:
Feb  7 12:23:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.250.78
country_id: 290557
description:
Feb  7 12:22:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.250.78 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.162.79.39
country_id: 1814991
description:
Feb  7 12:22:38 ait sshd[1778434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.162.79.39


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 12:22:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
country_id: 6252001
description:
Feb  7 12:23:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.162.79.39
country_id: 1814991
description:
Feb  7 12:22:38 ait sshd[1778434]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.162.79.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
country_id: 2017370
description:
2025-02-07 12:23:25 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:57242: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
country_id: 1562822
description:
Feb  7 12:22:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
Feb  7 12:23:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.180.193.176
country_id: 6252001
description:
Feb  7 12:23:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.180.193.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-02-07 12:24:16 dovecot_plain authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:57542: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
country_id: 1814991
description:
2025-02-07 12:23:30 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:51224: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-07 12:23:46 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:36501: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
country_id: 1269750
description:
2025-02-07 12:23:48 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.142.238]:37272: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
country_id: 1814991
description:
Feb  7 12:23:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.33.218.186
country_id: 298795
description:
Feb  7 12:24:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.33.218.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
country_id: 1814991
description:
Feb  7 12:23:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
country_id: 1814991
description:
2025-02-07 12:23:32 dovecot_plain authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:46038: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.228.242
country_id: 1814991
description:
2025-02-07 12:23:50 dovecot_plain authenticator failed for ([39.185.228.242]) [39.185.228.242]:46797: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.180.193.176
country_id: 6252001
description:
2025-02-07 12:24:01 dovecot_plain authenticator failed for wsip-184-180-193-176.tu.ok.cox.net [184.180.193.176]:59047: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  7 12:24:02 ait sshd[1779162]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  7 12:24:02 ait sshd[1779162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.178.23
country_id: 2963597
description:
2025-02-07 12:24:20 dovecot_login authenticator failed for (ADMIN) [188.241.178.23]:33646: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  7 12:23:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
country_id: 1269750
description:
Feb  7 12:23:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.228.242
country_id: 1814991
description:
Feb  7 12:23:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.228.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
country_id: 1814991
description:
Feb  7 12:25:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
country_id: 1814991
description:
2025-02-07 12:25:44 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:23946: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  7 12:25:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-07 12:25:58 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:56682: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.191.34.192
country_id: 3437598
description:
[2025-02-07 12:25:30 +0100] info [webmaild] 38.191.34.192 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 12:25:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
country_id: 732800
description:
2025-02-07 12:25:38 dovecot_plain authenticator failed for 9498.telnet.bg (unlitat) [87.254.165.100]:40254: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.232.242.24
country_id: 3469034
description:
[2025-02-07 12:26:17 +0100] info [webmaild] 181.232.242.24 - info@ait-ext.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
country_id: 732800
description:
Feb  7 12:25:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2025-02-07 12:26:30 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:38231: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  7 12:27:21 ait sshd[1781003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
country_id: 1814991
description:
2025-02-07 12:26:46 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:40594: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.230
country_id: 1814991
description:
Feb  7 12:26:48 ait sshd[1780607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.230  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.210.107.22
country_id: 3017382
description:
Feb  7 12:27:07 ait sshd[1780813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.210.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.210.107.22
country_id: 3017382
description:
Feb  7 12:27:07 ait sshd[1780813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.107.22


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  7 12:27:21 ait sshd[1781003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
country_id: 1835841
description:
Feb  7 12:26:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.230
country_id: 1814991
description:
Feb  7 12:26:48 ait sshd[1780607]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  7 12:26:51 ait sshd[1780626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.47.166  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
country_id: 1814991
description:
Feb  7 12:26:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  7 12:26:51 ait sshd[1780626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.47.166 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 8.218.212.177
country_id: 1819730
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:12-27.8.218.212.177


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.225
country_id: 1814991
description:
Feb  7 12:28:16 ait sshd[1781475]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
country_id: 690791
description:
Feb  7 12:28:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.225
country_id: 1814991
description:
Feb  7 12:28:16 ait sshd[1781475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.225  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
country_id: 690791
description:
2025-02-07 12:28:28 dovecot_plain authenticator failed for (misonow) [109.108.95.66]:42396: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.225
country_id: 1814991
description:
Feb  7 12:28:30 ait sshd[1781573]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
country_id: 6252001
description:
Feb  7 12:29:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
country_id: 6252001
description:
2025-02-07 12:29:27 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:62500: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.173.207.42
country_id: 831053
description:
[2025-02-07 12:29:30 +0100] info [webmaild] 185.173.207.42 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Feb  7 12:29:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
country_id: 1814991
description:
2025-02-07 12:30:14 dovecot_plain authenticator failed for ([58.34.174.90]) [58.34.174.90]:52952: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.74.21
country_id: 1814991
description:
Feb  7 12:30:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.74.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-02-07 12:29:48 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:51868: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
country_id: 1835841
description:
2025-02-07 12:30:08 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:53446: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.174.90
country_id: 1814991
description:
Feb  7 12:30:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.174.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
country_id: 1880251
description:
Feb  7 12:30:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.29
country_id: 6290252
description:
2025-02-07 12:30:58 dovecot_login authenticator failed for (ADMIN) [37.46.115.29]:42750: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
country_id: 1036973
description:
2025-02-07 12:31:22 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:59384: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.106.104
country_id: 6251999
description:
Feb  7 12:30:36 ait sshd[1782773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.222.106.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
country_id: 1880251
description:
2025-02-07 12:30:38 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:55442: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
country_id: 1814991
description:
Feb  7 12:30:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.115.29
country_id: 6290252
description:
Feb  7 12:30:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.115.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.74.21
country_id: 1814991
description:
2025-02-07 12:30:28 dovecot_plain authenticator failed for ([183.238.74.21]) [183.238.74.21]:49470: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.222.106.104
country_id: 6251999
description:
Feb  7 12:30:36 ait sshd[1782773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.222.106.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
country_id: 1036973
description:
Feb  7 12:31:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
country_id: 1814991
description:
2025-02-07 12:30:51 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:50111: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
country_id: 6252001
description:
Feb  7 12:31:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  7 12:31:53 ait sshd[1783301]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  7 12:31:53 ait sshd[1783301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
country_id: 6252001
description:
2025-02-07 12:31:34 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:38317: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  7 12:32:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.248.211.38
country_id: 1814991
description:
2025-02-07 12:32:46 dovecot_plain authenticator failed for ([183.71.251.66]) [113.248.211.38]:45508: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
country_id: 953987
description:
Feb  7 12:32:53 ait sshd[1783629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
country_id: 953987
description:
Feb  7 12:32:53 ait sshd[1783629]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-07 12:32:30 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:37014: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.248.211.38
country_id: 1814991
description:
Feb  7 12:32:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.248.211.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-07 12:34:21 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:42414: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
country_id: 3469034
description:
Feb  7 12:34:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  7 12:34:05 ait sshd[1784242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
country_id: 3469034
description:
2025-02-07 12:34:07 dovecot_plain authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:57984: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  7 12:34:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.109.92.170
country_id: 2017370
description:
Feb  7 12:33:47 ait sshd[1783989]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.109.92.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.109.92.170
country_id: 2017370
description:
Feb  7 12:33:47 ait sshd[1783989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.109.92.170  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  7 12:34:05 ait sshd[1784242]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
country_id: 1819730
description:
Feb  7 12:35:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.100.186.71
country_id: 6252001
description:
2025-02-07 12:34:41 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:39524: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 12:34:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
country_id: 1819730
description:
2025-02-07 12:35:11 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:12880: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.209.233.16
country_id: 953987
description:
[2025-02-07 12:35:20 +0100] info [webmaild] 105.209.233.16 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.100.186.71
country_id: 6252001
description:
Feb  7 12:34:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.100.186.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  7 12:35:44 ait sshd[1785126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.254.136.116 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-36.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.106.104
country_id: 6251999
description:
Feb  7 12:35:28 ait sshd[1785044]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.222.106.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  7 12:35:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.57.33.221
country_id: 1269750
description:
Feb  7 12:35:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.57.33.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
country_id: 1269750
description:
2025-02-07 12:35:51 dovecot_plain authenticator failed for ([120.57.33.221]) [120.57.33.221]:55516: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.222.106.104
country_id: 6251999
description:
Feb  7 12:35:28 ait sshd[1785044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.222.106.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.109.92.170
country_id: 2017370
description:
Feb  7 12:35:48 ait sshd[1785136]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.109.92.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 12:35:37 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:36433: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  7 12:35:44 ait sshd[1785126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.109.92.170
country_id: 2017370
description:
Feb  7 12:35:48 ait sshd[1785136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.109.92.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.32
country_id: 1880251
description:
47.128.16.32 - - [07/Feb/2025:12:36:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5643596 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=95%2C121%2C118&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.32


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.113.89
country_id: 1880251
description:
47.128.113.89 - - [07/Feb/2025:12:36:07 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 ait-edu.us "https://ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23203401" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.113.89


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
country_id: 6252001
description:
Feb  7 12:37:05 ait sshd[1785724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
country_id: 6252001
description:
Feb  7 12:37:05 ait sshd[1785724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.103.116
country_id: 1269750
description:
Feb  7 12:37:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.103.116 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Feb  7 12:36:42 ait sshd[1785507]: Failed password for invalid user shivam from 51.222.106.104 port 47978 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.109.92.170
country_id: 2017370
description:
Feb  7 12:36:58 ait sshd[1785647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.109.92.170


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.106.104
country_id: 6251999
description:
Feb  7 12:36:39 ait sshd[1785507]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.222.106.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.222.106.104
country_id: 6251999
description:
Feb  7 12:36:39 ait sshd[1785507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.222.106.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.109.92.170
country_id: 2017370
description:
Feb  7 12:36:58 ait sshd[1785647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.109.92.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.103.116
country_id: 1269750
description:
2025-02-07 12:37:24 dovecot_login authenticator failed for ([117.198.103.116]) [117.198.103.116]:58078: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.65.180.95
country_id: 1880251
domain: jabmar.org
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/json.php||SC:/home/titlemas/public_html/JABMAR.org/wp-content


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  7 12:37:51 ait sshd[1786071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2025-02-07 12:37:43 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:19732: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 40.65.180.95
country_id: 1880251
domain: jabmar.org
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:12-37.40.65.180.95||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.152.99.171
country_id: 6252001
description:
Feb  7 12:38:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.152.99.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
country_id: 6252001
description:
2025-02-07 12:38:03 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:55422: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.64
country_id: 1562822
description:
Feb  7 12:38:15 ait sshd[1786148]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
country_id: 2017370
description:
Feb  7 12:37:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  7 12:37:51 ait sshd[1786071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.64
country_id: 1562822
description:
Feb  7 12:38:15 ait sshd[1786148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.64  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.242.129
country_id: 99237
description:
Feb  7 12:38:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.242.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.242.129
country_id: 99237
description:
2025-02-07 12:38:58 dovecot_plain authenticator failed for (preted) [65.20.242.129]:40573: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
country_id: 1814991
description:
2025-02-07 12:39:05 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:49932: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
country_id: 3686110
description:
2025-02-07 12:38:50 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:38317: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
country_id: 3686110
description:
Feb  7 12:38:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 12:38:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
country_id: 1814991
description:
Feb  7 12:39:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.253.228
country_id: 3865483
description:
[2025-02-07 12:38:31 +0100] info [webmaild] 179.60.253.228 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
country_id: 1643084
description:
Feb  7 12:39:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.159.3
country_id: 3469034
description:
[2025-02-07 12:40:08 +0100] info [webmaild] 168.197.159.3 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.235.146
country_id: 1814991
description:
Feb  7 12:39:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.235.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.235.146
country_id: 1814991
description:
2025-02-07 12:39:41 dovecot_plain authenticator failed for ([27.45.235.146]) [27.45.235.146]:52345: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
country_id: 1643084
description:
2025-02-07 12:39:55 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:47014: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
country_id: 1814991
description:
2025-02-07 12:41:12 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:53400: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
country_id: 1835841
description:
2025-02-07 12:41:12 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:36256: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.79.13.45
country_id: 2017370
description:
Feb  7 12:41:18 ait sshd[1787471]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.79.13.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.79.13.45
country_id: 2017370
description:
Feb  7 12:41:18 ait sshd[1787471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.79.13.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
country_id: 617790
description:
Feb  7 12:41:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  7 12:41:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
country_id: 1814991
description:
Feb  7 12:41:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-07 12:41:23 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:49156: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
country_id: 1835841
description:
Feb  7 12:41:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
country_id: 3175395
description:
Feb  7 12:41:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.208.245
country_id: 1819730
description:
Feb  7 12:41:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.208.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.208.245
country_id: 1819730
description:
2025-02-07 12:41:47 dovecot_plain authenticator failed for (m121-202-208-245.smartone.com) [121.202.208.245]:43118: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-02-07 12:42:19 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:40270: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-07 12:41:27 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:34136: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
country_id: 6252001
description:
Feb  7 12:41:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
country_id: 6252001
description:
2025-02-07 12:41:31 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:45926: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
country_id: 1814991
description:
Feb  7 12:41:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
country_id: 1814991
description:
2025-02-07 12:41:59 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:37455: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 12:42:13 dovecot_login authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:45440: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
country_id: 1835841
description:
Feb  7 12:42:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
country_id: 1814991
description:
2025-02-07 12:41:43 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:40326: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
country_id: 3175395
description:
2025-02-07 12:41:43 dovecot_plain authenticator failed for (seorite) [82.84.122.203]:60921: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
country_id: 1814991
description:
Feb  7 12:41:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 12:42:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
country_id: 1269750
description:
2025-02-07 12:43:22 dovecot_plain authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:37154: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.122
country_id: 1880251
description:
Feb  7 12:43:04 ait sshd[1788003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Feb  7 12:43:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  7 12:43:17 ait sshd[1788020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  7 12:43:17 ait sshd[1788020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.33.247.45
country_id: 2661886
description:
Feb  7 12:43:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.33.247.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
country_id: 1269750
description:
Feb  7 12:43:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.33.247.45
country_id: 2661886
description:
2025-02-07 12:43:20 dovecot_plain authenticator failed for 92-33-247-45.customers.ownit.se (elatid) [92.33.247.45]:56767: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.106.137
country_id: 6252001
description:
2025-02-07 12:42:28 dovecot_login authenticator failed for (ADMIN) [191.96.106.137]:60334: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.225.170.89
country_id: 3469034
description:
[2025-02-07 12:42:45 +0100] info [webmaild] 45.225.170.89 - info@ijari.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.175.140.184
country_id: 617790
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-43.178.175.140.184


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.123.76.134
country_id: 2635167
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:12-43.109.123.76.134


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.141.229
country_id: 1880251
description:
Feb  7 12:42:34 ait sshd[1787929]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.141.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
country_id: 1819730
description:
Feb  7 12:42:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-02-07 12:43:18 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37274: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
country_id: 1819730
description:
2025-02-07 12:43:00 dovecot_login authenticator failed for ([121.202.152.120]) [121.202.152.120]:8037: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.122
country_id: 1880251
description:
Feb  7 12:43:04 ait sshd[1788003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.122


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.211.97.51
country_id: 1562822
description:
Feb  7 12:43:20 ait sshd[1788030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.211.97.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.11
country_id: 895949
description:
Feb  7 12:42:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.141.229
country_id: 1880251
description:
Feb  7 12:42:34 ait sshd[1787929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.141.229  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.11
country_id: 895949
description:
2025-02-07 12:42:35 dovecot_login authenticator failed for (ppp11-lumwana.zamnet.zm) [196.46.199.11]:53429: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.97.51
country_id: 1562822
description:
Feb  7 12:43:19 ait sshd[1788030]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.211.97.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
country_id: 3144096
description:
Feb  7 12:43:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
country_id: 3144096
description:
2025-02-07 12:43:33 dovecot_plain authenticator failed for (ip-199-1-248-87.eidsiva.net) [87.248.1.199]:39732: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 12:43:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 12:43:44 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:45516: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
country_id: 1819730
description:
2025-02-07 12:43:49 dovecot_login authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:25816: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-02-07 12:43:40 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:40128: 535 Incorrect authentication data (set_id=mumuni)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.175.120.25
country_id: 2782113
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:12-43.83.175.120.25


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
country_id: 1880251
description:
Feb  7 12:43:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
country_id: 1819730
description:
Feb  7 12:43:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
country_id: 1814991
description:
Feb  7 12:43:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
country_id: 1814991
description:
2025-02-07 12:44:00 dovecot_login authenticator failed for ([116.112.6.186]) [116.112.6.186]:37521: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.230.21.129
country_id: 1880251
domain: ait.university
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/assets/images/28c5400b0b.php||SC:/home/titlemas/public_html/ait.university/assets


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.230.21.129
country_id: 1880251
domain: ait.university
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:12-44.52.230.21.129||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
country_id: 1835841
description:
Feb  7 12:44:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
country_id: 798544
description:
Feb  7 12:44:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-02-07 12:44:42 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:34442: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 64.227.134.248
country_id: 1269750
domain: www.jabmar.org
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/api/.git/config||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.100.27
country_id: 1814991
description:
2025-02-07 12:44:58 dovecot_plain authenticator failed for ([183.24.100.27]) [183.24.100.27]:37932: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
country_id: 2661886
description:
Feb  7 12:45:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.36.198.78
country_id: 1814991
description:
Feb  7 12:44:36 ait sshd[1788640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.36.198.78  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
country_id: 2661886
description:
2025-02-07 12:45:14 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (calos) [188.149.132.246]:32826: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.36.198.78
country_id: 1814991
description:
Feb  7 12:44:36 ait sshd[1788640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.36.198.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
country_id: 2077456
description:
Feb  7 12:44:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.100.27
country_id: 1814991
description:
Feb  7 12:44:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.100.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.35
country_id: 2395170
description:
Feb  7 12:45:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
country_id: 2395170
description:
2025-02-07 12:45:09 dovecot_plain authenticator failed for ([154.127.43.35]) [154.127.43.35]:60202: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  7 12:45:15 ait sshd[1788888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
country_id: 1835841
description:
2025-02-07 12:44:28 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:40492: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  7 12:45:15 ait sshd[1788888]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
country_id: 798544
description:
2025-02-07 12:44:44 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (syntrally) [188.127.16.197]:42340: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 64.227.134.248
country_id: 1269750
domain: www.jabmar.org
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/public/.git/config||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.221.29.123
country_id: 1512440
description:
Feb  7 12:45:34 ait sshd[1789184]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.221.29.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.19.163
country_id: 1269750
description:
2025-02-07 12:45:49 dovecot_plain authenticator failed for ([122.160.19.163]) [122.160.19.163]:33973: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.79.13.45
country_id: 2017370
description:
Feb  7 12:45:56 ait sshd[1789234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.79.13.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.99
country_id: 3865483
description:
2025-02-07 12:46:04 dovecot_login authenticator failed for (ADMIN) [146.70.38.99]:34282: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
country_id: 6252001
description:
Feb  7 12:46:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-02-07 12:46:26 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:59610: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.221.29.123
country_id: 1512440
description:
Feb  7 12:45:34 ait sshd[1789184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.221.29.123  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  7 12:45:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.79.13.45
country_id: 2017370
description:
Feb  7 12:45:56 ait sshd[1789234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.79.13.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-07 12:45:56 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:42584: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.49.14
country_id: 1814991
description:
Feb  7 12:46:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.49.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
country_id: 1668284
description:
2025-02-07 12:46:08 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:40408: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2025-02-07 12:46:09 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:13158: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  7 12:46:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.96
country_id: 1835841
description:
Feb  7 12:45:46 ait sshd[1789210]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.10.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.10.96
country_id: 1835841
description:
Feb  7 12:45:46 ait sshd[1789210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.10.96  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.70.38.99
country_id: 3865483
description:
Feb  7 12:46:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.70.38.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
country_id: 1668284
description:
Feb  7 12:46:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-07 12:46:18 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (overs) [109.67.154.24]:57106: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.96
country_id: 1835841
description:
Feb  7 12:47:23 ait sshd[1789602]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.10.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
country_id: 1814991
description:
Feb  7 12:46:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.179.56.249
country_id: 1643084
description:
Feb  7 12:46:51 ait sshd[1789490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.179.56.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.79.13.45
country_id: 2017370
description:
Feb  7 12:47:08 ait sshd[1789530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.79.13.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-02-07 12:47:18 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:42414: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
country_id: 1814991
description:
2025-02-07 12:46:46 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:50301: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.79.13.45
country_id: 2017370
description:
Feb  7 12:47:09 ait sshd[1789530]: Failed password for invalid user ftpsecure from 94.79.13.45 port 57374 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
country_id: 337996
description:
Feb  7 12:47:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.79.13.45
country_id: 2017370
description:
Feb  7 12:47:08 ait sshd[1789530]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.79.13.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.179.56.249
country_id: 1643084
description:
Feb  7 12:46:51 ait sshd[1789490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.56.249


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.10.96
country_id: 1835841
description:
Feb  7 12:47:23 ait sshd[1789602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.10.96


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
country_id: 2264397
description:
Feb  7 12:47:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
country_id: 294640
description:
2025-02-07 12:47:31 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:53987: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.196.210.167
country_id: 298795
description:
[2025-02-07 12:47:36 +0100] info [webmaild] 46.196.210.167 - info@gvu.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-02-07 12:47:40 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:50417: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
country_id: 6252001
description:
Feb  7 12:47:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
country_id: 6252001
description:
2025-02-07 12:47:40 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:58542: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 12:47:54 ait sshd[1789866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.122
country_id: 1880251
description:
Feb  7 12:48:05 ait sshd[1789912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.122  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
country_id: 290557
description:
Feb  7 12:47:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
country_id: 294640
description:
Feb  7 12:47:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-02-07 12:47:30 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:50493: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
country_id: 3932488
description:
Feb  7 12:47:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-02-07 12:48:13 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (menally) [195.159.217.71]:37374: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
country_id: 2017370
description:
2025-02-07 12:48:17 dovecot_plain authenticator failed for (anocers) [77.239.255.163]:59638: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.221.48
country_id: 1835841
description:
Feb  7 12:48:19 ait sshd[1789957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.221.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.221.48
country_id: 1835841
description:
Feb  7 12:48:19 ait sshd[1789957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.221.48  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-07 12:47:30 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:42954: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.122
country_id: 1880251
description:
Feb  7 12:48:05 ait sshd[1789912]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
country_id: 2017370
description:
Feb  7 12:48:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 12:47:54 ait sshd[1789866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.56.56
country_id: 1880251
description:
47.128.56.56 - - [07/Feb/2025:12:47:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12581331 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/c2c011/search/results?ip=47.128.126.25&limit=10" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.56.56


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
country_id: 3144096
description:
Feb  7 12:48:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
country_id: 1814991
description:
Feb  7 12:48:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.96
country_id: 1835841
description:
Feb  7 12:48:48 ait sshd[1790154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.10.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.188.78.64
country_id: 6252001
description:
2025-02-07 12:49:10 dovecot_plain authenticator failed for ool-18bc4e40.dyn.optonline.net [24.188.78.64]:59063: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
country_id: 1269750
description:
Feb  7 12:49:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
country_id: 1814991
description:
2025-02-07 12:48:34 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:45238: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Feb  7 12:48:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.188.78.64
country_id: 6252001
description:
Feb  7 12:49:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.188.78.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-07 12:49:27 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:47425: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.222.230
country_id: 6252001
description:
Feb  7 12:48:36 ait sshd[1790112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.222.230


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-02-07 12:48:45 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:36677: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
country_id: 1814991
description:
2025-02-07 12:48:51 dovecot_plain authenticator failed for ([218.206.136.24]) [218.206.136.24]:45796: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.10.96
country_id: 1835841
description:
Feb  7 12:48:48 ait sshd[1790154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.10.96


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
country_id: 1814991
description:
Feb  7 12:48:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.207.72
country_id: 1814991
description:
Feb  7 12:49:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.207.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.207.72
country_id: 1814991
description:
2025-02-07 12:49:05 dovecot_plain authenticator failed for ([120.236.207.72]) [120.236.207.72]:39589: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.165.114
country_id: 1269750
description:
2025-02-07 12:50:24 dovecot_plain authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:52567: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.179.56.249
country_id: 1643084
description:
Feb  7 12:50:02 ait sshd[1790726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.56.249  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.165.114
country_id: 1269750
description:
Feb  7 12:50:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
country_id: 6252001
description:
Feb  7 12:50:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-02-07 12:50:26 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:39928: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.122
country_id: 1880251
description:
Feb  7 12:49:35 ait sshd[1790592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.122
country_id: 1880251
description:
Feb  7 12:49:35 ait sshd[1790592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.122  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.179.56.249
country_id: 1643084
description:
Feb  7 12:50:02 ait sshd[1790726]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.179.56.249 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-51.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.42.100
country_id: 1668284
description:
Feb  7 12:51:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.42.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
country_id: 1668284
description:
2025-02-07 12:51:18 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:17232: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.155.40.158
country_id: 1835841
description:
Feb  7 12:50:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.155.40.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.155.40.158
country_id: 1835841
description:
2025-02-07 12:50:44 dovecot_login authenticator failed for ([218.155.40.158]) [218.155.40.158]:42477: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  7 12:51:02 ait sshd[1791363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  7 12:51:02 ait sshd[1791363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
country_id: 6252001
description:
Feb  7 12:51:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
country_id: 1835841
description:
Feb  7 12:50:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-02-07 12:50:49 dovecot_plain authenticator failed for ([211.196.31.2]) [211.196.31.2]:35299: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
country_id: 2658434
description:
Feb  7 12:51:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-02-07 12:51:15 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:37582: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
country_id: 2328926
description:
Feb  7 12:51:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
country_id: 1880251
description:
Feb  7 12:52:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
country_id: 1269750
description:
Feb  7 12:51:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.36.198.78
country_id: 1814991
description:
Feb  7 12:51:37 ait sshd[1791652]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.36.198.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-02-07 12:51:43 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:55696: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-02-07 12:51:51 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:50299: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
country_id: 3175395
description:
Feb  7 12:51:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
country_id: 3175395
description:
2025-02-07 12:51:54 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:54942: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.179.56.249
country_id: 1643084
description:
Feb  7 12:51:57 ait sshd[1791767]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.179.56.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.179.56.249
country_id: 1643084
description:
Feb  7 12:51:57 ait sshd[1791767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.56.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
country_id: 1880251
description:
2025-02-07 12:52:05 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:43592: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
country_id: 6252001
description:
2025-02-07 12:51:28 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:57677: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.36.198.78
country_id: 1814991
description:
Feb  7 12:51:37 ait sshd[1791652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.36.198.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
country_id: 6252001
description:
Feb  7 12:53:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
country_id: 1835841
description:
Feb  7 12:52:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
country_id: 1835841
description:
2025-02-07 12:52:35 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:58578: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
country_id: 1668284
description:
Feb  7 12:53:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
country_id: 1814991
description:
2025-02-07 12:52:46 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:40432: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.99.54
country_id: 6252001
description:
Feb  7 12:52:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
country_id: 1814991
description:
Feb  7 12:52:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
country_id: 1668284
description:
2025-02-07 12:53:10 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:39326: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
country_id: 6252001
description:
2025-02-07 12:53:21 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:58212: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.199.99.54
country_id: 6252001
description:
2025-02-07 12:52:51 dovecot_login authenticator failed for (1224312.cloudwaysapps.com) [24.199.99.54]:16400: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
country_id: 3996063
description:
Feb  7 12:53:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
country_id: 3996063
description:
2025-02-07 12:53:28 dovecot_login authenticator failed for (host-115-208-static-98-201.uninet-ide.com.mx) [201.98.208.115]:46062: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
country_id: 1835841
description:
Feb  7 12:53:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
country_id: 1835841
description:
2025-02-07 12:53:44 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:34048: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 12:54:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.122.245
country_id: 1269750
description:
Feb  7 12:54:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.122.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.135.252.106
country_id: 458258
description:
[2025-02-07 12:55:17 +0100] info [webmaild] 195.135.252.106 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.20.128
country_id: 2510769
description:
2025-02-07 12:55:17 dovecot_plain authenticator failed for (localhost) [208.85.20.128]:40922: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.114.53
country_id: 1835841
description:
Feb  7 12:54:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.114.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
country_id: 1819730
description:
2025-02-07 12:54:51 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:57447: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-02-07 12:54:28 dovecot_plain authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:46395: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
country_id: 2077456
description:
2025-02-07 12:54:41 dovecot_plain authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:34614: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.114.53
country_id: 1835841
description:
2025-02-07 12:54:41 dovecot_login authenticator failed for ([211.228.114.53]) [211.228.114.53]:59870: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
country_id: 1819730
description:
Feb  7 12:54:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.103.74
country_id: 1668284
description:
Feb  7 12:54:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.198.31
country_id: 1814991
description:
Feb  7 12:54:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.198.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.74
country_id: 1668284
description:
2025-02-07 12:54:53 dovecot_login authenticator failed for 110-25-103-74.adsl.fetnet.net [110.25.103.74]:49992: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2025-02-07 12:54:55 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:47198: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
country_id: 2077456
description:
Feb  7 12:54:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
country_id: 1819730
description:
2025-02-07 12:54:38 dovecot_login authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:48120: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
country_id: 1814991
description:
2025-02-07 12:54:56 dovecot_plain authenticator failed for ([125.69.76.148]) [125.69.76.148]:56575: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.95.223.139
country_id: 1643084
description:
Feb  7 12:55:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.95.223.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.95.223.139
country_id: 1643084
description:
2025-02-07 12:55:26 dovecot_plain authenticator failed for ([36.95.223.139]) [36.95.223.139]:37282: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
country_id: 1819730
description:
Feb  7 12:54:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
country_id: 1814991
description:
Feb  7 12:54:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
country_id: 1814991
description:
Feb  7 12:56:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-02-07 12:55:33 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:33162: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
country_id: 1814991
description:
Feb  7 12:56:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
country_id: 1814991
description:
2025-02-07 12:56:04 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:46456: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
country_id: 1814991
description:
2025-02-07 12:56:19 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:46293: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.104.222.189
country_id: 1835841
description:
Feb  7 12:56:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.104.222.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
country_id: 458258
description:
Feb  7 12:55:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
country_id: 2510769
description:
Feb  7 12:55:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-02-07 12:55:52 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:47652: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.112
country_id: 1814991
description:
Feb  7 12:56:29 ait sshd[1793632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.112  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
country_id: 1694008
description:
2025-02-07 12:56:31 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:61736: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-02-07 12:57:23 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:55720: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.112
country_id: 1814991
description:
Feb  7 12:56:29 ait sshd[1793632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.20.128
country_id: 2510769
description:
2025-02-07 12:56:32 dovecot_plain authenticator failed for (localhost) [208.85.20.128]:54418: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.236
country_id: 1814991
description:
Feb  7 12:56:37 ait sshd[1793686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.236 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.93.158.240
country_id: 6251999
description:
Feb  7 12:57:12 ait sshd[1793948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.158.240


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
country_id: 1814991
description:
Feb  7 12:56:37 ait sshd[1793686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
country_id: 2635167
description:
Feb  7 12:56:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
country_id: 2635167
description:
2025-02-07 12:56:47 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:44438: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.158.240
country_id: 6251999
description:
Feb  7 12:57:12 ait sshd[1793948]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.93.158.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
country_id: 1835841
description:
2025-02-07 12:57:12 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:41376: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.222.189
country_id: 1835841
description:
2025-02-07 12:56:29 dovecot_plain authenticator failed for ([210.104.222.189]) [210.104.222.189]:36261: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
country_id: 798544
description:
Feb  7 12:56:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
country_id: 798544
description:
2025-02-07 12:56:36 dovecot_plain authenticator failed for (reced) [93.159.152.6]:57252: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
country_id: 1835841
description:
Feb  7 12:57:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Feb  7 12:57:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
country_id: 1694008
description:
Feb  7 12:56:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.155.13.140
country_id: 1814991
description:
Feb  7 12:57:35 ait sshd[1794075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.155.13.140 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.155.13.140
country_id: 1814991
description:
Feb  7 12:57:35 ait sshd[1794075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.155.13.140  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.186.75
country_id: 1814991
description:
Feb  7 12:58:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.186.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
country_id: 290557
description:
2025-02-07 12:57:49 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:51534: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
country_id: 1210997
description:
Feb  7 12:58:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
country_id: 1210997
description:
2025-02-07 12:58:08 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:39713: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.186.75
country_id: 1814991
description:
2025-02-07 12:58:11 dovecot_plain authenticator failed for ([183.237.186.75]) [183.237.186.75]:44560: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
country_id: 6252001
description:
Feb  7 12:58:18 ait sshd[1794427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.3
country_id: 1835841
description:
Feb  7 12:57:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.22
country_id: 2589581
description:
2025-02-07 12:58:16 dovecot_login authenticator failed for (ADMIN) [176.125.228.22]:43082: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.113.61.126
country_id: 298795
description:
Feb  7 12:58:05 ait sshd[1794346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.113.61.126  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
country_id: 290557
description:
Feb  7 12:57:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
country_id: 2017370
description:
Feb  7 12:57:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
country_id: 2017370
description:
2025-02-07 12:57:55 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:57386: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.113.61.126
country_id: 298795
description:
Feb  7 12:58:05 ait sshd[1794346]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.113.61.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-07 12:59:04 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:10724: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.64.224.24
country_id: 2077456
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:12-59.170.64.224.24


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.36.198.78
country_id: 1814991
description:
Feb  7 12:58:34 ait sshd[1794490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.36.198.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
country_id: 1835841
description:
Feb  7 12:58:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  7 12:59:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.9.180
country_id: 99237
description:
[2025-02-07 12:59:17 +0100] info [webmaild] 169.224.9.180 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.20.128
country_id: 2510769
description:
2025-02-07 12:58:46 dovecot_plain authenticator failed for (localhost) [208.85.20.128]:46856: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.36.198.78
country_id: 1814991
description:
Feb  7 12:58:34 ait sshd[1794490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.36.198.78  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
country_id: 1835841
description:
2025-02-07 12:58:48 dovecot_login authenticator failed for ([220.124.240.66]) [220.124.240.66]:59090: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.52.218
country_id: 3144096
description:
Feb  7 12:59:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.52.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 13:00:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  7 12:59:55 ait sshd[1795336]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.52.218
country_id: 3144096
description:
2025-02-07 12:59:57 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no (humphion) [94.246.52.218]:45632: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  7 12:59:55 ait sshd[1795336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.239.237
country_id: 3469034
description:
[2025-02-07 13:00:12 +0100] info [webmaild] 201.49.239.237 - info@aitopen.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.78
country_id: 1562822
description:
Feb  7 13:01:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
country_id: 1835841
description:
Feb  7 13:01:10 ait sshd[1796143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
country_id: 1835841
description:
Feb  7 13:01:10 ait sshd[1796143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.197.16.58
country_id: 3996063
description:
[2025-02-07 13:00:30 +0100] info [webmaild] 189.197.16.58 - info@university-publishing.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.252.135
country_id: 798544
description:
2025-02-07 13:00:39 dovecot_plain authenticator failed for (localhost) [70.34.252.135]:60342: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.253.18.251
country_id: 1814991
description:
2025-02-07 13:00:59 dovecot_plain authenticator failed for ([120.253.18.251]) [120.253.18.251]:47491: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  7 13:00:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-07 13:01:20 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:47067: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
country_id: 1835841
description:
Feb  7 13:01:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-07 13:00:49 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (quidae) [91.56.31.167]:64482: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.253.18.251
country_id: 1814991
description:
Feb  7 13:00:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.253.18.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
country_id: 1562822
description:
2025-02-07 13:01:13 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:42346: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
country_id: 6252001
description:
Feb  7 13:01:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
country_id: 1835841
description:
2025-02-07 13:01:26 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:49058: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
country_id: 1814991
description:
Feb  7 13:02:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  7 13:02:10 ait sshd[1796529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.155.13.140
country_id: 1814991
description:
Feb  7 13:02:13 ait sshd[1796534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.155.13.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.252.135
country_id: 798544
description:
2025-02-07 13:01:35 dovecot_plain authenticator failed for (localhost) [70.34.252.135]:52252: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
country_id: 3175395
description:
Feb  7 13:02:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
country_id: 1814991
description:
2025-02-07 13:02:09 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:25948: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
country_id: 3175395
description:
2025-02-07 13:02:10 dovecot_login authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:59787: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
country_id: 1814991
description:
2025-02-07 13:02:03 dovecot_login authenticator failed for ([61.133.10.205]) [61.133.10.204]:46992: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
country_id: 1814991
description:
Feb  7 13:02:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 13:01:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  7 13:02:10 ait sshd[1796529]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.155.13.140
country_id: 1814991
description:
Feb  7 13:02:13 ait sshd[1796534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.155.13.140  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.51.183
country_id: 1880251
description:
47.128.51.183 - - [07/Feb/2025:13:02:26 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21735227 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/exercise/?filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.51.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
country_id: 1835841
description:
Feb  7 13:02:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
country_id: 1835841
description:
2025-02-07 13:02:31 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:48628: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.58.118
country_id: 1835841
description:
Feb  7 13:02:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.58.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  7 13:03:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-07 13:03:12 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:56210: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-02-07 13:03:18 dovecot_plain authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:58550: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.58.118
country_id: 1835841
description:
2025-02-07 13:02:45 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:52284: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
country_id: 1814991
description:
Feb  7 13:02:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.137
country_id: 1819730
description:
Feb  7 13:03:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 13:03:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
country_id: 1814991
description:
2025-02-07 13:02:56 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:26691: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 13:03:03 ait sshd[1797093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 13:03:03 ait sshd[1797093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.20.128
country_id: 2510769
description:
2025-02-07 13:03:06 dovecot_plain authenticator failed for (localhost) [208.85.20.128]:38304: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 13:03:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
country_id: 1814991
description:
2025-02-07 13:03:43 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:43356: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
country_id: 1835841
description:
Feb  7 13:04:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
country_id: 1814991
description:
Feb  7 13:04:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
country_id: 1814991
description:
Feb  7 13:03:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
country_id: 6252001
description:
Feb  7 13:04:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.155.13.140
country_id: 1814991
description:
Feb  7 13:03:42 ait sshd[1797292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.155.13.140  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.155.13.140
country_id: 1814991
description:
Feb  7 13:03:42 ait sshd[1797292]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.155.13.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.75.68.16
country_id: 1562822
description:
Feb  7 13:03:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.75.68.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
country_id: 1819730
description:
Feb  7 13:03:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
country_id: 3469034
description:
2025-02-07 13:04:16 dovecot_login authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:55984: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
country_id: 2661886
description:
Feb  7 13:04:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
country_id: 2661886
description:
2025-02-07 13:04:26 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (pation) [83.233.242.245]:33600: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  7 13:03:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 13:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
country_id: 1814991
description:
2025-02-07 13:03:59 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:38804: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
country_id: 1835841
description:
2025-02-07 13:04:03 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:35002: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.75.68.16
country_id: 1562822
description:
2025-02-07 13:03:41 dovecot_plain authenticator failed for ([27.75.68.16]) [27.75.68.16]:59390: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
country_id: 1819730
description:
2025-02-07 13:03:47 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:54080: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.46.20
country_id: 1861060
description:
2025-02-07 13:03:59 dovecot_plain authenticator failed for p285021-obmd01.tokyo.ocn.ne.jp [153.141.46.20]:49326: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
country_id: 1814991
description:
Feb  7 13:03:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
country_id: 3469034
description:
Feb  7 13:04:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
country_id: 6252001
description:
2025-02-07 13:04:21 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:42568: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
country_id: 1814991
description:
2025-02-07 13:04:05 dovecot_login authenticator failed for ([116.113.253.178]) [116.113.253.178]:48743: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 13:03:35 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:45692: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.46.20
country_id: 1861060
description:
Feb  7 13:03:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.46.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 13:05:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-07 13:05:44 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:55529: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-07 13:06:07 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:52402: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.230.22.120
country_id: 1880251
domain: lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/assets/images/28c5400b0b.php||SC:/home/lemsas/public_html/assets/images/28c5400b0b.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.18
country_id: 1814991
description:
Feb  7 13:06:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  7 13:06:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
country_id: 2542007
description:
Feb  7 13:06:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.230.22.120
country_id: 1880251
domain: lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-05.52.230.22.120||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  7 13:05:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-05.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
country_id: 1835841
description:
Feb  7 13:05:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-07 13:05:49 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:33020: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.18
country_id: 1814991
description:
2025-02-07 13:06:04 dovecot_plain authenticator failed for ([125.90.72.18]) [125.90.72.18]:39089: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
country_id: 1819730
description:
2025-02-07 13:07:09 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:35291: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
country_id: 1819730
description:
Feb  7 13:07:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
country_id: 3469034
description:
2025-02-07 13:07:10 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:44168: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
country_id: 3469034
description:
Feb  7 13:07:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.62.117.48
country_id: 1814991
description:
2025-02-07 13:07:21 dovecot_plain authenticator failed for ([117.62.117.48]) [117.62.117.48]:43803: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  7 13:07:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-02-07 13:06:27 dovecot_plain authenticator failed for (perallitte) [41.248.243.181]:46894: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 13:06:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
country_id: 1814991
description:
Feb  7 13:08:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.108.86.181
country_id: 3469034
description:
[2025-02-07 13:08:05 +0100] info [webmaild] 131.108.86.181 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Feb  7 13:07:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.84
country_id: 1819730
description:
Feb  7 13:07:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-02-07 13:07:50 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:28600: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
country_id: 6252001
description:
2025-02-07 13:07:58 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:34302: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.58.173
country_id: 6251999
description:
Feb  7 13:08:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.58.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 13:07:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 13:07:35 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:56926: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2025-02-07 13:08:04 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:56967: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.20.128
country_id: 2510769
description:
2025-02-07 13:07:31 dovecot_plain authenticator failed for (localhost) [208.85.20.128]:59240: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-02-07 13:07:40 dovecot_plain authenticator failed for ([187.51.128.233]) [189.44.133.238]:49794: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
country_id: 6252001
description:
Feb  7 13:07:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
country_id: 2635167
description:
Feb  7 13:08:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.58.173
country_id: 6251999
description:
2025-02-07 13:08:14 dovecot_plain authenticator failed for ([192.199.58.173]) [192.199.58.173]:37684: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-07 13:07:28 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:42803: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
country_id: 1835841
description:
2025-02-07 13:08:47 dovecot_login authenticator failed for ([180.71.9.57]) [180.71.9.57]:44548: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  7 13:08:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-07 13:08:58 dovecot_plain authenticator failed for (baters) [77.51.214.170]:52607: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-02-07 13:08:30 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:30494: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
country_id: 1835841
description:
Feb  7 13:08:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.84
country_id: 1819730
description:
Feb  7 13:08:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  7 13:09:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
country_id: 3175395
description:
Feb  7 13:09:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.220
country_id: 1814991
description:
Feb  7 13:09:38 ait sshd[1800139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.220  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
country_id: 3175395
description:
2025-02-07 13:09:41 dovecot_plain authenticator failed for ([82.84.122.203]) [82.84.122.203]:60497: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-07 13:09:53 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:55700: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 85.214.47.113
country_id: 2921044
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-09.85.214.47.113


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.220
country_id: 1814991
description:
Feb  7 13:09:38 ait sshd[1800139]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.110.219
country_id: 3865483
description:
[2025-02-07 13:11:16 +0100] info [webmaild] 45.172.110.219 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.114
country_id: 1814991
description:
Feb  7 13:10:45 ait sshd[1800738]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.114
country_id: 1814991
description:
Feb  7 13:10:45 ait sshd[1800738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.114  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.57.160
country_id: 1835841
description:
2025-02-07 13:12:25 dovecot_plain authenticator failed for ([119.207.57.160]) [119.207.57.160]:44493: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:13-11.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
country_id: 1814991
description:
Feb  7 13:11:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.67
country_id: 99237
description:
Feb  7 13:11:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
country_id: 1814991
description:
Feb  7 13:12:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.57.160
country_id: 1835841
description:
Feb  7 13:12:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.57.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
country_id: 1814991
description:
2025-02-07 13:11:57 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:19942: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-07 13:11:40 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:45177: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
country_id: 1814991
description:
Feb  7 13:11:35 ait sshd[1801081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  7 13:11:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-02-07 13:11:58 dovecot_plain authenticator failed for (mycitian) [65.20.129.67]:40714: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
country_id: 1814991
description:
2025-02-07 13:12:14 dovecot_plain authenticator failed for ([219.144.16.16]) [219.144.16.16]:60881: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
country_id: 1814991
description:
Feb  7 13:13:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
country_id: 3017382
description:
Feb  7 13:12:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.133
country_id: 99237
description:
Feb  7 13:12:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.133
country_id: 99237
description:
2025-02-07 13:12:39 dovecot_plain authenticator failed for (exemia) [65.20.193.133]:51048: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
country_id: 1835841
description:
Feb  7 13:13:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
country_id: 3017382
description:
2025-02-07 13:12:36 dovecot_plain authenticator failed for (esteorifs) [185.113.49.23]:50454: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-07 13:13:06 dovecot_plain authenticator failed for ([1.180.230.98]) [1.180.230.98]:56684: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 40.65.191.252
country_id: 1880251
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:13-13.40.65.191.252||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.154.105.128
country_id: 1562822
description:
Feb  7 13:13:09 ait sshd[1801685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.105.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-02-07 13:13:20 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:37594: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 13:13:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
country_id: 1814991
description:
Feb  7 13:15:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.150.182
country_id: 1168579
description:
Feb  7 13:15:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.150.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
country_id: 1168579
description:
2025-02-07 13:15:17 dovecot_plain authenticator failed for ([182.176.150.182]) [182.176.150.182]:37333: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.209.153
country_id: 1814991
description:
2025-02-07 13:15:18 dovecot_plain authenticator failed for ([39.174.209.153]) [39.174.209.153]:57861: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 13:14:34 ait sshd[1802681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.187.126.130
country_id: 1814991
description:
Feb  7 13:15:11 ait sshd[1803442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.187.126.130  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 13:14:34 ait sshd[1802681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.187.126.130
country_id: 1814991
description:
Feb  7 13:15:11 ait sshd[1803442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.187.126.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-02-07 13:15:39 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:39397: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
country_id: 1814991
description:
Feb  7 13:15:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.164.190
country_id: 2017370
description:
2025-02-07 13:15:56 dovecot_login authenticator failed for (Sogaz-gw.Irkutsk.gldn.net) [195.239.164.190]:34278: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  7 13:15:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  7 13:16:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-07 13:16:04 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:52726: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
country_id: 1668284
description:
2025-02-07 13:15:30 dovecot_plain authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:45902: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
country_id: 690791
description:
Feb  7 13:15:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-07 13:16:05 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:36063: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  7 13:16:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.215.126.22
country_id: 1814991
description:
Feb  7 13:15:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.215.126.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.215.126.22
country_id: 1814991
description:
2025-02-07 13:15:30 dovecot_plain authenticator failed for ([60.215.126.22]) [60.215.126.22]:47539: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  7 13:15:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-07 13:15:42 dovecot_login authenticator failed for (cust61-165.63.41.tvcabo.ao) [41.63.165.61]:51359: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
country_id: 1668284
description:
Feb  7 13:15:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.119.84.18
country_id: 1562822
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:13-15.45.119.84.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
country_id: 1835841
description:
2025-02-07 13:15:50 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:50460: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.239.164.190
country_id: 2017370
description:
Feb  7 13:15:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.239.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-07 13:16:01 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:35075: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  7 13:16:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-07 13:16:16 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:16712: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
country_id: 1835841
description:
Feb  7 13:15:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2025-02-07 13:15:49 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:54245: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
country_id: 1814991
description:
2025-02-07 13:16:52 dovecot_login authenticator failed for ([183.196.174.235]) [183.196.174.235]:22179: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.226
country_id: 1814991
description:
Feb  7 13:16:53 ait sshd[1804338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.226  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
country_id: 2017370
description:
2025-02-07 13:17:23 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (hyden) [5.228.154.62]:47030: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
country_id: 1814991
description:
Feb  7 13:16:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-07 13:16:33 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:50856: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.226
country_id: 1814991
description:
Feb  7 13:16:53 ait sshd[1804338]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
country_id: 2017370
description:
Feb  7 13:17:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  7 13:16:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
country_id: 732800
description:
Feb  7 13:17:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
country_id: 1814991
description:
Feb  7 13:17:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
country_id: 1819730
description:
2025-02-07 13:17:45 dovecot_login authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:18063: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
country_id: 1814991
description:
Feb  7 13:18:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.206.128
country_id: 6252001
description:
Feb  7 13:18:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.206.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
country_id: 1819730
description:
Feb  7 13:17:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:13-17.3.109.181.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
country_id: 1814991
description:
2025-02-07 13:18:15 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:42256: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.128
country_id: 6252001
description:
2025-02-07 13:18:19 dovecot_login authenticator failed for (ADMIN) [181.41.206.128]:42660: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 13:17:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
country_id: 1814991
description:
2025-02-07 13:17:46 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:46922: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
country_id: 1831722
description:
Feb  7 13:17:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-02-07 13:17:59 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:45316: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  7 13:18:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
country_id: 732800
description:
2025-02-07 13:17:31 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:39327: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-07 13:18:25 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:56791: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
country_id: 1814991
description:
Feb  7 13:18:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
country_id: 1835841
description:
Feb  7 13:18:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
country_id: 1835841
description:
2025-02-07 13:18:48 dovecot_plain authenticator failed for ([211.243.43.58]) [211.243.43.58]:52222: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-02-07 13:18:58 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:55977: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.239.252.94
country_id: 1819730
description:
2025-02-07 13:19:09 dovecot_plain authenticator failed for 061239252094.static.ctinets.com [61.239.252.94]:8860: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
country_id: 1814991
description:
2025-02-07 13:18:35 dovecot_plain authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:43078: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.153
country_id: 3041565
description:
2025-02-07 13:18:53 dovecot_login authenticator failed for (ADMIN) [173.239.217.153]:11752: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
country_id: 1880251
description:
Feb  7 13:18:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 13:19:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.239.252.94
country_id: 1819730
description:
Feb  7 13:19:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.239.252.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
country_id: 1814991
description:
Feb  7 13:19:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-07 13:19:33 dovecot_login authenticator failed for ([120.24.83.156]) [223.104.199.27]:10798: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  7 13:19:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-07 13:19:46 dovecot_login authenticator failed for ([211.109.75.66]) [211.109.75.69]:54391: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-20.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 13:20:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.186.253
country_id: 1814991
description:
Feb  7 13:21:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.186.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
country_id: 1835841
description:
Feb  7 13:21:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
country_id: 1269750
description:
2025-02-07 13:21:58 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:50114: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
country_id: 1835841
description:
2025-02-07 13:21:59 dovecot_login authenticator failed for ([118.218.10.21]) [118.218.10.21]:50070: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
country_id: 1819730
description:
2025-02-07 13:22:20 dovecot_login authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:12785: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-02-07 13:21:32 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:34233: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-02-07 13:22:02 dovecot_login authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:48856: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  7 13:21:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-07 13:21:42 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:44843: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.251.193
country_id: 1861060
description:
2025-02-07 13:21:45 dovecot_plain authenticator failed for p176194-obmd01.osaka.ocn.ne.jp [61.118.251.193]:33110: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.72.147.10
country_id: 1814991
description:
Feb  7 13:22:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.72.147.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.72.147.10
country_id: 1814991
description:
2025-02-07 13:22:15 dovecot_plain authenticator failed for ([180.166.163.26]) [222.72.147.10]:33244: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
country_id: 1210997
description:
Feb  7 13:21:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
country_id: 1814991
description:
2025-02-07 13:21:46 dovecot_plain authenticator failed for ([222.67.186.253]) [222.67.186.253]:36024: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
country_id: 1269750
description:
Feb  7 13:21:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
country_id: 1880251
description:
Feb  7 13:22:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
country_id: 1819730
description:
Feb  7 13:22:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.194.158
country_id: 1814991
description:
2025-02-07 13:23:07 dovecot_plain authenticator failed for ([60.15.194.158]) [60.15.194.158]:47561: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
country_id: 2017370
description:
Feb  7 13:23:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
country_id: 2017370
description:
2025-02-07 13:23:15 dovecot_plain authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:51382: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
country_id: 3865483
description:
Feb  7 13:22:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
country_id: 3865483
description:
2025-02-07 13:22:44 dovecot_login authenticator failed for ([201.234.106.218]) [201.234.106.218]:51485: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  7 13:22:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-07 13:22:58 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:36892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.15.194.158
country_id: 1814991
description:
Feb  7 13:23:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.15.194.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
country_id: 798549
description:
Feb  7 13:24:23 ait sshd[1809903]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
country_id: 798549
description:
Feb  7 13:24:23 ait sshd[1809903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
country_id: 1835841
description:
2025-02-07 13:24:25 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:38318: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 13:23:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.37.209
country_id: 1880251
description:
47.128.37.209 - - [07/Feb/2025:13:24:19 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11229116 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/audio-production/?filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.37.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
country_id: 1835841
description:
Feb  7 13:24:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.42
country_id: 2635167
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-24.77.83.1.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
country_id: 3175395
description:
Feb  7 13:24:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-02-07 13:24:36 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:38273: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:13-24.3.109.181.164


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.154.105.128
country_id: 1562822
description:
Feb  7 13:25:06 ait sshd[1810447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.105.128


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
country_id: 6252001
description:
Feb  7 13:25:37 ait sshd[1810697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
country_id: 6252001
description:
Feb  7 13:25:37 ait sshd[1810697]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
country_id: 1562822
description:
Feb  7 13:25:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
country_id: 1643084
description:
Feb  7 13:26:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
country_id: 2017370
description:
Feb  7 13:26:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-02-07 13:26:02 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:41004: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
country_id: 2017370
description:
2025-02-07 13:26:02 dovecot_plain authenticator failed for (ovexcia) [81.211.77.58]:14269: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
country_id: 1835841
description:
Feb  7 13:26:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2025-02-07 13:26:08 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:59512: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
country_id: 1835841
description:
2025-02-07 13:26:25 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:55920: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.158
country_id: 1668284
description:
Feb  7 13:26:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
country_id: 1562822
description:
2025-02-07 13:25:54 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:57693: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2025-02-07 13:26:14 dovecot_plain authenticator failed for 111-70-29-158.emome-ip.hinet.net [111.70.29.158]:41470: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
country_id: 1835841
description:
Feb  7 13:26:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.155.27.128
country_id: 2802361
description:
Feb  7 13:26:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.155.27.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-02-07 13:27:00 dovecot_plain authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:59919: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.154
country_id: 1668284
description:
Feb  7 13:27:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
country_id: 1668284
description:
2025-02-07 13:27:19 dovecot_plain authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:38864: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.154.105.128
country_id: 1562822
description:
Feb  7 13:27:15 ait sshd[1811722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.105.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
country_id: 6252001
description:
Feb  7 13:27:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
country_id: 6252001
description:
2025-02-07 13:27:26 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:55216: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  7 13:26:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-07 13:26:37 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:35932: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.250.23.208
country_id: 6252001
description:
Feb  7 13:27:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.250.23.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.23.208
country_id: 6252001
description:
2025-02-07 13:27:11 dovecot_plain authenticator failed for ([72.250.23.208]) [72.250.23.208]:59222: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
country_id: 1819730
description:
Feb  7 13:27:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
country_id: 1269750
description:
Feb  7 13:27:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
country_id: 1269750
description:
2025-02-07 13:27:39 dovecot_login authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:49690: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
country_id: 1814991
description:
Feb  7 13:28:02 ait sshd[1812156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 13:28:23 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-179.static.tpgi.com.au) [110.175.220.250]:37007: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-07 13:27:29 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:38850: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.208
country_id: 99237
description:
Feb  7 13:27:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-02-07 13:27:36 dovecot_plain authenticator failed for (undus) [65.20.133.208]:34719: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 13:28:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 13:27:52 ait sshd[1812033]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 13:27:52 ait sshd[1812033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
country_id: 2328926
description:
Feb  7 13:29:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
country_id: 1835841
description:
Feb  7 13:29:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2025-02-07 13:29:13 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:21178: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.108.172.220
country_id: 1814991
description:
Feb  7 13:29:15 ait sshd[1812692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.108.172.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.74
country_id: 1668284
description:
2025-02-07 13:28:49 dovecot_plain authenticator failed for 110-25-103-74.adsl.fetnet.net [110.25.103.74]:44005: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
country_id: 2328926
description:
2025-02-07 13:29:02 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:50792: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.218.126.161
country_id: 1819730
description:
Feb  7 13:28:40 ait sshd[1812475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.218.126.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.103.74
country_id: 1668284
description:
Feb  7 13:28:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.215.162
country_id: 2661886
description:
2025-02-07 13:30:23 dovecot_plain authenticator failed for 90-230-215-162-no2430.tbcn.telia.com (arlical) [90.230.215.162]:41636: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
country_id: 1562822
description:
2025-02-07 13:30:24 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:58532: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  7 13:29:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-07 13:29:44 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (lurgery) [109.67.154.24]:52886: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.215.162
country_id: 2661886
description:
Feb  7 13:30:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.215.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
country_id: 1562822
description:
Feb  7 13:30:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-07 13:30:34 dovecot_plain authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:48452: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.88.175.184
country_id: 298795
description:
[2025-02-07 13:30:43 +0100] info [webmaild] 176.88.175.184 - info@aitsmartschool.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.200.44
country_id: 3658394
description:
[2025-02-07 13:30:59 +0100] info [webmaild] 45.4.200.44 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 82.197.67.100
country_id: 6252001
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:13-31.82.197.67.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 13:31:12 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pulable) [87.103.126.54]:41780: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Feb  7 13:30:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.77.178.94
country_id: 3469034
description:
[2025-02-07 13:30:43 +0100] info [webmaild] 200.77.178.94 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 13:31:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.118.208.37
country_id: 3175395
description:
Feb  7 13:31:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.118.208.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
country_id: 2215636
description:
2025-02-07 13:31:57 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:54276: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.4.133
country_id: 2017370
description:
2025-02-07 13:32:19 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:40182: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
country_id: 6252001
description:
Feb  7 13:31:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
country_id: 3017382
description:
2025-02-07 13:31:56 dovecot_plain authenticator failed for (phole) [185.113.51.55]:46881: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 13:32:04 ait sshd[1814869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.231
country_id: 1814991
description:
Feb  7 13:32:00 ait sshd[1814802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.4.133
country_id: 2017370
description:
Feb  7 13:32:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.4.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
country_id: 298795
description:
2025-02-07 13:32:12 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:36888: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
country_id: 6252001
description:
2025-02-07 13:31:46 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:35570: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
country_id: 2215636
description:
Feb  7 13:31:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
country_id: 6252001
description:
Feb  7 13:31:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.231
country_id: 1814991
description:
Feb  7 13:32:00 ait sshd[1814802]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:13-32.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
country_id: 298795
description:
Feb  7 13:32:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
country_id: 6252001
description:
2025-02-07 13:31:31 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:51053: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.199.245
country_id: 798544
description:
2025-02-07 13:31:35 dovecot_login authenticator failed for 5.185.199.245.ipv4.public.orange.pl [5.185.199.245]:35416: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 13:31:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.118.208.37
country_id: 3175395
description:
2025-02-07 13:31:46 dovecot_login authenticator failed for host-2-118-208-37.business.telecomitalia.it [2.118.208.37]:36182: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
country_id: 3017382
description:
Feb  7 13:31:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 13:32:04 ait sshd[1814869]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
country_id: 1814991
description:
Feb  7 13:31:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.199.245
country_id: 798544
description:
Feb  7 13:31:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.199.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
country_id: 1814991
description:
2025-02-07 13:31:34 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:38338: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
country_id: 798549
description:
Feb  7 13:32:32 ait sshd[1815310]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
country_id: 798549
description:
Feb  7 13:32:32 ait sshd[1815310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
country_id: 1835841
description:
2025-02-07 13:34:15 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:48802: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-02-07 13:33:31 dovecot_plain authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:46925: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
country_id: 1814991
description:
Feb  7 13:33:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.78.222
country_id: 1835841
description:
Feb  7 13:33:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.78.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
country_id: 1814991
description:
2025-02-07 13:33:45 dovecot_plain authenticator failed for ([58.18.88.146]) [58.18.88.146]:42153: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.78.222
country_id: 1835841
description:
2025-02-07 13:33:47 dovecot_plain authenticator failed for ([211.57.78.222]) [211.57.78.222]:44628: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
country_id: 1835841
description:
Feb  7 13:34:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  7 13:34:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Feb  7 13:33:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
country_id: 1814991
description:
Feb  7 13:34:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  7 13:34:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-07 13:34:59 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:40818: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
country_id: 1814991
description:
Feb  7 13:35:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
country_id: 3469034
description:
2025-02-07 13:35:05 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:48088: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
country_id: 2017370
description:
Feb  7 13:35:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
country_id: 2017370
description:
2025-02-07 13:35:26 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:49516: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-07 13:34:27 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:40364: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
country_id: 1814991
description:
2025-02-07 13:34:51 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:42770: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-34.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
country_id: 3469034
description:
Feb  7 13:35:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
country_id: 1814991
description:
2025-02-07 13:35:03 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:56513: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
country_id: 6252001
description:
2025-02-07 13:36:08 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:43069: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  7 13:36:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
country_id: 3469034
description:
Feb  7 13:36:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-07 13:36:11 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:60444: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
country_id: 1814991
description:
Feb  7 13:36:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
country_id: 1835841
description:
Feb  7 13:36:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Feb  7 13:35:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-02-07 13:35:36 dovecot_plain authenticator failed for (plastic) [65.20.149.93]:42968: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
country_id: 1835841
description:
2025-02-07 13:36:23 dovecot_login authenticator failed for ([115.140.89.82]) [115.140.89.82]:42310: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
country_id: 6252001
description:
Feb  7 13:36:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
country_id: 3469034
description:
2025-02-07 13:36:12 dovecot_login authenticator failed for (200-153-56-145.sgsnet.com.br) [187.92.192.154]:57426: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
country_id: 1814991
description:
2025-02-07 13:36:04 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:34896: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  7 13:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.101.45.51
country_id: 6252001
description:
Feb  7 13:36:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.101.45.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
country_id: 798544
description:
Feb  7 13:37:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-07 13:36:31 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:60530: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.101.45.51
country_id: 6252001
description:
2025-02-07 13:36:47 dovecot_plain authenticator failed for ([129.101.45.51]) [129.101.45.51]:51341: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.148.36.64
country_id: 6252001
description:
Feb  7 13:36:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.148.36.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.148.36.64
country_id: 6252001
description:
2025-02-07 13:36:55 dovecot_plain authenticator failed for 64.sub-166-148-36.myvzw.com [166.148.36.64]:42616: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
country_id: 798544
description:
2025-02-07 13:37:24 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:50180: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.14.179.108
country_id: 1835841
description:
2025-02-07 13:38:10 dovecot_plain authenticator failed for ([59.14.179.108]) [59.14.179.108]:51890: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.118.94
country_id: 1835841
description:
2025-02-07 13:38:16 dovecot_plain authenticator failed for ([211.228.118.94]) [211.228.118.94]:52622: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.223
country_id: 1814991
description:
Feb  7 13:37:53 ait sshd[1818345]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
country_id: 1269750
description:
2025-02-07 13:37:53 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:55894: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
country_id: 1269750
description:
Feb  7 13:37:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.223
country_id: 1814991
description:
Feb  7 13:37:53 ait sshd[1818345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.223  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
country_id: 2623032
description:
Feb  7 13:38:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
country_id: 298795
description:
2025-02-07 13:37:30 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:51520: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
country_id: 2017370
description:
2025-02-07 13:37:32 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:59500: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-07 13:37:52 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:42222: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
country_id: 2661886
description:
Feb  7 13:38:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
country_id: 2661886
description:
2025-02-07 13:38:07 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (acing) [188.149.132.246]:38762: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.241.34.61
country_id: 248816
description:
[2025-02-07 13:38:13 +0100] info [webmaild] 92.241.34.61 - info@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 13:37:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
country_id: 1835841
description:
Feb  7 13:37:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.14.179.108
country_id: 1835841
description:
Feb  7 13:38:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.14.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.118.94
country_id: 1835841
description:
Feb  7 13:38:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.118.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-02-07 13:38:26 dovecot_plain authenticator failed for (gably) [84.238.92.245]:59182: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
country_id: 298795
description:
Feb  7 13:37:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
country_id: 2017370
description:
Feb  7 13:37:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
country_id: 3865483
description:
Feb  7 13:39:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 13:39:25 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:33636: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
country_id: 2017370
description:
2025-02-07 13:39:10 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:59206: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 13:39:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.85
country_id: 1819730
description:
2025-02-07 13:38:36 dovecot_plain authenticator failed for (m121-202-152-85.smartone.com) [121.202.152.85]:35757: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-07 13:39:06 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:45948: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
country_id: 2017370
description:
Feb  7 13:39:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
country_id: 1814991
description:
Feb  7 13:39:16 ait sshd[1818921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 13:38:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.237
country_id: 1814991
description:
Feb  7 13:39:16 ait sshd[1818921]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.85
country_id: 1819730
description:
Feb  7 13:38:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
country_id: 3865483
description:
2025-02-07 13:39:21 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:41336: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.237
country_id: 1814991
description:
Feb  7 13:39:29 ait sshd[1819091]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 13:39:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.247.195
country_id: 2017370
description:
Feb  7 13:40:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.247.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-07 13:40:18 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:59894: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
country_id: 1814991
description:
Feb  7 13:39:29 ait sshd[1819091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.247.195
country_id: 2017370
description:
2025-02-07 13:40:06 dovecot_plain authenticator failed for ([46.138.247.195]) [46.138.247.195]:59586: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 13:40:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  7 13:40:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
country_id: 798549
description:
Feb  7 13:40:29 ait sshd[1819813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.66.235.99
country_id: 2802361
description:
2025-02-07 13:40:30 dovecot_plain authenticator failed for (steripers) [87.66.235.99]:43570: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
country_id: 2017370
description:
2025-02-07 13:40:44 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:60402: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
country_id: 1814991
description:
Feb  7 13:40:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.66.235.99
country_id: 2802361
description:
Feb  7 13:40:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.66.235.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.168
country_id: 2186224
description:
2025-02-07 13:40:58 dovecot_login authenticator failed for (ADMIN) [179.61.240.168]:39832: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
country_id: 798549
description:
Feb  7 13:40:29 ait sshd[1819813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:13-40.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  7 13:41:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-07 13:41:26 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:55877: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
country_id: 1814991
description:
2025-02-07 13:40:29 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:6215: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
country_id: 2017370
description:
Feb  7 13:40:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 13:41:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
country_id: 3469034
description:
Feb  7 13:41:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
country_id: 3469034
description:
2025-02-07 13:41:52 dovecot_plain authenticator failed for 179-236-213-190.user.veloxzone.com.br [179.236.213.190]:47893: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.210.250
country_id: 3469034
description:
Feb  7 13:41:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.210.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.210.250
country_id: 3469034
description:
2025-02-07 13:41:56 dovecot_plain authenticator failed for ([187.12.210.250]) [187.12.210.250]:58617: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 13:41:34 ait sshd[1820187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 13:41:34 ait sshd[1820187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
country_id: 6252001
description:
2025-02-07 13:43:18 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:53018: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.187
country_id: 1269750
description:
Feb  7 13:43:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.187
country_id: 1269750
description:
2025-02-07 13:43:08 dovecot_plain authenticator failed for ([103.146.233.187]) [103.146.233.187]:49711: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 13:43:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
country_id: 617790
description:
Feb  7 13:43:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
country_id: 6252001
description:
Feb  7 13:43:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
country_id: 617790
description:
2025-02-07 13:43:20 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:59608: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-07 13:44:09 dovecot_login authenticator failed for ([183.105.138.168]) [211.35.237.38]:50358: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
country_id: 1835841
description:
Feb  7 13:44:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
country_id: 1269750
description:
2025-02-07 13:43:38 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:39282: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.113.109
country_id: 2017370
description:
2025-02-07 13:43:40 dovecot_plain authenticator failed for (mette) [95.105.113.109]:42786: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.238
country_id: 2802361
description:
2025-02-07 13:44:01 dovecot_login authenticator failed for (x7REOtE) [149.22.90.238]:10511: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
country_id: 1814991
description:
Feb  7 13:44:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
country_id: 1814991
description:
2025-02-07 13:44:26 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:43155: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
country_id: 1269750
description:
Feb  7 13:43:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.105.113.109
country_id: 2017370
description:
Feb  7 13:43:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.105.113.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-07 13:44:45 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:42438: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  7 13:45:24 ait sshd[1821806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  7 13:45:24 ait sshd[1821806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
country_id: 6251999
description:
Feb  7 13:44:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
country_id: 6251999
description:
2025-02-07 13:44:34 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:50859: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.238
country_id: 2802361
description:
2025-02-07 13:44:38 dovecot_login authenticator failed for (rpMPRb) [149.22.90.238]:10823: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  7 13:44:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
country_id: 3469034
description:
Feb  7 13:45:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
country_id: 3469034
description:
2025-02-07 13:45:47 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:47936: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
country_id: 1814991
description:
Feb  7 13:46:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
country_id: 1814991
description:
2025-02-07 13:46:09 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:42189: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.249.147.146
country_id: 6252001
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:13-47.173.249.147.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Feb  7 13:47:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
country_id: 1835841
description:
Feb  7 13:46:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
country_id: 1814991
description:
Feb  7 13:46:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
country_id: 1835841
description:
2025-02-07 13:46:54 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:18295: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
country_id: 1814991
description:
2025-02-07 13:46:56 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:46283: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.42.105
country_id: 1835841
description:
Feb  7 13:47:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.42.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.42.105
country_id: 1835841
description:
2025-02-07 13:47:19 dovecot_plain authenticator failed for ([112.184.42.105]) [112.184.42.105]:55742: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.70.107
country_id: 99237
description:
[2025-02-07 13:47:21 +0100] info [webmaild] 37.77.70.107 - info@jaster.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 13:47:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-02-07 13:47:14 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:46836: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.177.90.113
country_id: 2661886
description:
Feb  7 13:48:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.177.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.177.90.113
country_id: 2661886
description:
2025-02-07 13:48:21 dovecot_plain authenticator failed for c151-177-90-113.bredband.tele2.se (hyabass) [151.177.90.113]:53990: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.173.66.99
country_id: 1562822
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-47.103.173.66.99


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
country_id: 1562822
description:
2025-02-07 13:49:07 dovecot_login authenticator failed for ([171.244.63.34]) [171.244.63.34]:28740: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
country_id: 2017370
description:
Feb  7 13:49:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
country_id: 2017370
description:
2025-02-07 13:49:24 dovecot_login authenticator failed for (broadband-37.204-174-45.ip.moscow.rt.ru) [37.204.174.45]:49196: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  7 13:48:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.123.40.94
country_id: 1269750
description:
Feb  7 13:49:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.123.40.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.123.40.94
country_id: 1269750
description:
2025-02-07 13:49:08 dovecot_plain authenticator failed for (124.123.40.94.actcorp.in) [124.123.40.94]:19802: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
country_id: 1814991
description:
Feb  7 13:49:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
country_id: 1814991
description:
2025-02-07 13:49:22 dovecot_login authenticator failed for ([60.223.239.134]) [60.223.239.134]:57469: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-07 13:48:55 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:60802: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.34
country_id: 1562822
description:
Feb  7 13:49:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-02-07 13:49:49 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:48464: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.216.85.119
country_id: 1835841
description:
Feb  7 13:49:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.216.85.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-02-07 13:49:43 dovecot_plain authenticator failed for (flatical) [102.53.15.17]:44840: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Feb  7 13:49:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
country_id: 3469034
description:
Feb  7 13:49:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.85.119
country_id: 1835841
description:
2025-02-07 13:49:38 dovecot_login authenticator failed for ([211.216.85.119]) [211.216.85.119]:51186: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Feb  7 13:49:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
country_id: 1835841
description:
Feb  7 13:50:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2025-02-07 13:50:21 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:41291: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
country_id: 3469034
description:
2025-02-07 13:49:38 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:51718: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-49.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.37.36.251
country_id: 1168579
description:
[2025-02-07 13:50:01 +0100] info [webmaild] 110.37.36.251 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.157
country_id: 3865483
description:
Feb  7 13:51:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
country_id: 3469034
description:
Feb  7 13:51:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
country_id: 1814991
description:
Feb  7 13:51:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-02-07 13:51:03 dovecot_plain authenticator failed for ([170.233.29.157]) [170.233.29.157]:60309: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
country_id: 3469034
description:
2025-02-07 13:51:21 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:57142: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
country_id: 3017382
description:
Feb  7 13:51:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
country_id: 1814991
description:
2025-02-07 13:51:25 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:42990: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
country_id: 3017382
description:
2025-02-07 13:51:27 dovecot_plain authenticator failed for (supropha) [185.113.49.23]:60537: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.24.152.80
country_id: 6252001
description:
Feb  7 13:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.24.152.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 13:50:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.24.152.80
country_id: 6252001
description:
2025-02-07 13:50:32 dovecot_plain authenticator failed for ([50.24.152.80]) [50.24.152.80]:37869: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
country_id: 6252001
description:
Feb  7 13:51:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
country_id: 6252001
description:
2025-02-07 13:51:42 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:61102: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.26.221.84
country_id: 1269750
description:
2025-02-07 13:51:45 dovecot_login authenticator failed for (ADMIN) [23.26.221.84]:34816: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.215.179.154
country_id: 1814991
description:
Feb  7 13:52:17 ait sshd[1824875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.215.179.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.215.179.154
country_id: 1814991
description:
Feb  7 13:52:17 ait sshd[1824875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.215.179.154


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
country_id: 6252001
description:
Feb  7 13:52:46 ait sshd[1825092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
country_id: 6252001
description:
Feb  7 13:52:46 ait sshd[1825092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
country_id: 1835841
description:
2025-02-07 13:52:48 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:55256: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.131.79
country_id: 1814991
description:
Feb  7 13:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.131.79 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.120.176.32
country_id: 1269750
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-53.103.120.176.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
country_id: 2017370
description:
Feb  7 13:53:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-07 13:52:30 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:40853: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
country_id: 798544
description:
Feb  7 13:52:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
country_id: 798544
description:
2025-02-07 13:52:40 dovecot_plain authenticator failed for ([31.41.81.24]) [31.41.81.24]:44080: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-02-07 13:52:47 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:47383: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
country_id: 2017370
description:
2025-02-07 13:53:13 dovecot_plain authenticator failed for data.autofrant.ru (ditous) [151.248.116.230]:56380: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.1.60
country_id: 1835841
description:
Feb  7 13:52:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.1.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
country_id: 1835841
description:
Feb  7 13:52:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.131.79
country_id: 1814991
description:
2025-02-07 13:53:02 dovecot_plain authenticator failed for ([111.53.131.79]) [111.53.131.79]:54002: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  7 13:52:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
country_id: 6252001
description:
Feb  7 13:54:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
country_id: 6252001
description:
2025-02-07 13:54:18 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:34024: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
country_id: 1814991
description:
Feb  7 13:54:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
country_id: 3865483
description:
Feb  7 13:53:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
country_id: 3865483
description:
2025-02-07 13:53:47 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:50544: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
country_id: 2510769
description:
Feb  7 13:54:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.213.248
country_id: 1814991
description:
Feb  7 13:53:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.213.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-02-07 13:54:25 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:52987: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
country_id: 1814991
description:
Feb  7 13:54:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
country_id: 1814991
description:
2025-02-07 13:54:08 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:45474: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
country_id: 2510769
description:
2025-02-07 13:54:10 dovecot_plain authenticator failed for (metris) [207.188.157.230]:1168: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
country_id: 1814991
description:
Feb  7 13:53:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
country_id: 1814991
description:
2025-02-07 13:53:31 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:42056: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.100
country_id: 1880251
description:
47.128.54.100 - - [07/Feb/2025:13:53:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27469535 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/52a47d?group=1&panel=db" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.213.248
country_id: 1814991
description:
2025-02-07 13:53:41 dovecot_plain authenticator failed for ([183.237.213.248]) [183.237.213.248]:53922: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:13-53.3.109.181.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-07 13:54:50 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:51949: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
country_id: 6252001
description:
Feb  7 13:55:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
country_id: 6252001
description:
2025-02-07 13:55:04 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:37307: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
country_id: 6252001
description:
Feb  7 13:55:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  7 13:54:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
country_id: 6252001
description:
2025-02-07 13:55:26 dovecot_plain authenticator failed for (antis) [96.239.87.6]:39574: 535 Incorrect authentication data (set_id=chavez_4068@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
country_id: 1814991
description:
Feb  7 13:54:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
country_id: 1814991
description:
2025-02-07 13:54:36 dovecot_login authenticator failed for ([60.173.218.7]) [60.173.218.7]:45751: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
country_id: 1814991
description:
2025-02-07 13:56:18 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:36532: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
country_id: 453733
description:
Feb  7 13:56:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 13:56:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.92.10
country_id: 3469034
description:
[2025-02-07 13:55:52 +0100] info [webmaild] 177.84.92.10 - info@ait.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
country_id: 1562822
description:
Feb  7 13:55:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
country_id: 1562822
description:
2025-02-07 13:55:55 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:55804: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
country_id: 1814991
description:
Feb  7 13:56:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-02-07 13:56:43 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:41487: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
country_id: 1880251
description:
Feb  7 13:56:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
country_id: 1880251
description:
2025-02-07 13:56:54 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:60230: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.137
country_id: 99237
description:
Feb  7 13:57:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.137
country_id: 99237
description:
2025-02-07 13:57:25 dovecot_plain authenticator failed for (cinapper) [65.20.251.137]:49764: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
country_id: 3469034
description:
Feb  7 13:56:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
country_id: 1269750
description:
2025-02-07 13:57:59 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:51014: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.3.72
country_id: 1668284
description:
2025-02-07 13:58:13 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:42460: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
country_id: 2921044
description:
Feb  7 13:58:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  7 13:58:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-07 13:58:26 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:56387: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2025-02-07 13:58:19 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:51831: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
country_id: 1880251
description:
Feb  7 13:58:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
country_id: 1814991
description:
2025-02-07 13:58:16 dovecot_plain authenticator failed for ([220.248.205.14]) [220.248.205.14]:1285: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
country_id: 1814991
description:
Feb  7 13:58:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
country_id: 1269750
description:
Feb  7 13:57:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
country_id: 1880251
description:
2025-02-07 13:58:08 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:36541: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.3.72
country_id: 1668284
description:
Feb  7 13:58:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.3.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-07 13:59:14 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:35986: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
country_id: 1269750
description:
Feb  7 13:58:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.129.27
country_id: 1814991
description:
Feb  7 13:58:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.129.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.129.27
country_id: 1814991
description:
2025-02-07 13:58:48 dovecot_plain authenticator failed for ([120.196.129.27]) [120.196.129.27]:55897: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
country_id: 1835841
description:
2025-02-07 13:58:56 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:52574: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
country_id: 1880251
description:
Feb  7 13:59:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
country_id: 298795
description:
2025-02-07 13:59:10 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:37902: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  7 13:59:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
country_id: 3469034
description:
Feb  7 13:59:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-02-07 13:58:39 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:39812: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.177.38
country_id: 1814991
description:
Feb  7 13:58:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.177.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
country_id: 298795
description:
Feb  7 13:59:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
country_id: 2661886
description:
Feb  7 13:59:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
country_id: 2661886
description:
2025-02-07 13:59:10 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:34722: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
country_id: 1880251
description:
2025-02-07 13:59:12 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:48336: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.177.38
country_id: 1814991
description:
2025-02-07 13:58:49 dovecot_plain authenticator failed for ([124.115.177.38]) [124.115.177.38]:48456: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
country_id: 3469034
description:
Feb  7 13:58:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
country_id: 1835841
description:
Feb  7 13:58:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-07 13:58:59 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:44408: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
country_id: 3469034
description:
2025-02-07 13:59:20 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:39194: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.86.23
country_id: 3469034
description:
[2025-02-07 13:59:31 +0100] info [webmaild] 45.163.86.23 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
country_id: 6252001
description:
Feb  7 14:00:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
country_id: 6252001
description:
2025-02-07 14:00:06 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:50618: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
country_id: 6252001
description:
Feb  7 14:00:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
country_id: 6252001
description:
2025-02-07 14:00:18 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:35638: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  7 14:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-07 14:01:22 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:56720: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.57
country_id: 690791
description:
2025-02-07 14:01:26 dovecot_login authenticator failed for (ADMIN) [84.239.42.57]:54470: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 14:01:00 ait sshd[1828617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 14:01:00 ait sshd[1828617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.110.204
country_id: 1880251
description:
47.128.110.204 - - [07/Feb/2025:14:01:53 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 ait-edu.us "https://ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9614119" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
country_id: 1814991
description:
Feb  7 14:01:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 14:02:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
country_id: 1814991
description:
2025-02-07 14:01:59 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:55306: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
country_id: 1643084
description:
Feb  7 14:02:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
country_id: 1643084
description:
2025-02-07 14:02:09 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:56826: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
country_id: 1814991
description:
Feb  7 14:01:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
country_id: 2017370
description:
2025-02-07 14:02:18 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:46295: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
country_id: 1269750
description:
Feb  7 14:02:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-02-07 14:02:11 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:36506: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.44.148.14
country_id: 298795
description:
[2025-02-07 14:02:02 +0100] info [webmaild] 92.44.148.14 - info@ait-edu.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 14:02:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
country_id: 1814991
description:
2025-02-07 14:01:46 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:53714: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
country_id: 2017370
description:
Feb  7 14:02:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.62
country_id: 99237
description:
Feb  7 14:03:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
country_id: 6252001
description:
Feb  7 14:03:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.62
country_id: 99237
description:
2025-02-07 14:03:25 dovecot_plain authenticator failed for (suries) [65.20.193.62]:55996: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-02-07 14:03:25 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:42740: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
country_id: 1269750
description:
Feb  7 14:03:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
country_id: 1269750
description:
2025-02-07 14:03:13 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:41898: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
country_id: 1814991
description:
Feb  7 14:04:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
country_id: 1814991
description:
2025-02-07 14:04:06 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:56170: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
country_id: 1819730
description:
Feb  7 14:04:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 49.51.50.12
country_id: 6252001
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:14-03.49.51.50.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
country_id: 1819730
description:
2025-02-07 14:04:28 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:17408: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
country_id: 732800
description:
2025-02-07 14:04:30 dovecot_plain authenticator failed for 9498.telnet.bg (irapthys) [87.254.165.100]:35274: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
country_id: 294640
description:
2025-02-07 14:04:34 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:44986: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
country_id: 2017370
description:
Feb  7 14:04:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-04.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-02-07 14:04:53 dovecot_plain authenticator failed for ([203.172.213.166]) [203.172.213.166]:37506: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
country_id: 732800
description:
Feb  7 14:04:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
country_id: 294640
description:
Feb  7 14:04:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
country_id: 2017370
description:
2025-02-07 14:04:42 dovecot_plain authenticator failed for (denesen) [81.211.77.58]:62629: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 14:05:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  7 14:05:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
country_id: 1835841
description:
Feb  7 14:05:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
country_id: 3469034
description:
2025-02-07 14:05:43 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:53957: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-07 14:05:58 dovecot_plain authenticator failed for (giltring) [65.20.205.197]:48380: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
country_id: 1814991
description:
Feb  7 14:06:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
country_id: 1814991
description:
2025-02-07 14:06:23 dovecot_plain authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:33578: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
country_id: 1835841
description:
2025-02-07 14:05:30 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:35703: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
country_id: 3469034
description:
Feb  7 14:05:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
country_id: 1814991
description:
2025-02-07 14:06:41 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:55933: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
country_id: 1814991
description:
2025-02-07 14:07:02 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:60482: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
country_id: 1814991
description:
Feb  7 14:06:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
country_id: 1814991
description:
Feb  7 14:07:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.90.218.138
country_id: 6251999
description:
2025-02-07 14:07:15 dovecot_plain authenticator failed for ([174.90.218.138]) [174.90.218.138]:12177: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.160.245.147
country_id: 1814991
description:
2025-02-07 14:07:24 dovecot_plain authenticator failed for ([123.160.245.147]) [123.160.245.147]:33132: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-07 14:06:46 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:55866: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  7 14:06:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.160.245.147
country_id: 1814991
description:
Feb  7 14:07:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.160.245.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
country_id: 1512440
description:
2025-02-07 14:06:30 dovecot_plain authenticator failed for ([195.158.19.6]) [195.158.19.6]:37322: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.90.218.138
country_id: 6251999
description:
Feb  7 14:07:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.90.218.138 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 149.202.42.249
country_id: 3017382
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-07.149.202.42.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
country_id: 1512440
description:
Feb  7 14:06:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-02-07 14:07:39 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:36382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  7 14:07:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-07 14:07:48 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (antric) [91.56.31.167]:61099: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
country_id: 2017370
description:
Feb  7 14:07:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
country_id: 1835841
description:
2025-02-07 14:08:04 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:49629: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.162
country_id: 6252001
description:
2025-02-07 14:07:43 dovecot_login authenticator failed for (ADMIN) [191.96.67.162]:48332: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-07 14:08:00 dovecot_plain authenticator failed for (unpester) [88.87.84.104]:53056: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
country_id: 1835841
description:
Feb  7 14:08:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.125.24
country_id: 99237
description:
[2025-02-07 14:07:36 +0100] info [webmaild] 37.236.125.24 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
country_id: 49518
description:
Feb  7 14:07:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
country_id: 2017370
description:
Feb  7 14:07:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.96.67.162
country_id: 6252001
description:
Feb  7 14:07:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.96.67.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
country_id: 2017370
description:
2025-02-07 14:07:42 dovecot_login authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:45390: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.201
country_id: 1861060
description:
2025-02-07 14:08:41 dovecot_plain authenticator failed for p160202-obmd01.osaka.ocn.ne.jp [61.112.103.201]:60230: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
country_id: 1819730
description:
Feb  7 14:08:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
country_id: 2017370
description:
Feb  7 14:09:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
country_id: 2017370
description:
2025-02-07 14:09:27 dovecot_plain authenticator failed for (peiggloan) [81.211.77.58]:32834: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:14-09.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
country_id: 2017370
description:
Feb  7 14:08:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-02-07 14:08:34 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:59506: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.112.103.201
country_id: 1861060
description:
Feb  7 14:08:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.112.103.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
country_id: 1819730
description:
2025-02-07 14:08:47 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:22999: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
country_id: 2661886
description:
Feb  7 14:09:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
country_id: 2661886
description:
2025-02-07 14:09:02 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:57082: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
country_id: 6252001
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:eng18b00179y||WPU:eng18b00179y||RSV:6.65||T:APACHE||MV:14-09.170.205.31.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.228.150
country_id: 1814991
description:
2025-02-07 14:10:05 dovecot_plain authenticator failed for ([222.170.228.150]) [222.170.228.150]:54394: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
country_id: 3923057
description:
Feb  7 14:10:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-02-07 14:10:17 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:50234: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
country_id: 2017370
description:
Feb  7 14:10:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
country_id: 1835841
description:
2025-02-07 14:10:37 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:34698: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
country_id: 1835841
description:
Feb  7 14:10:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
country_id: 6252001
description:
Feb  7 14:10:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2025-02-07 14:10:28 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:51014: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
country_id: 1835841
description:
Feb  7 14:10:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 14:10:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
country_id: 1814991
description:
Feb  7 14:10:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
country_id: 1814991
description:
2025-02-07 14:10:42 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:49886: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
country_id: 1835841
description:
2025-02-07 14:10:50 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:37309: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
country_id: 6252001
description:
2025-02-07 14:11:00 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:44908: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 14:11:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
country_id: 1605651
description:
Feb  7 14:11:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-02-07 14:11:35 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:47518: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
country_id: 2635167
description:
Feb  7 14:11:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
country_id: 2635167
description:
2025-02-07 14:11:43 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:50506: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 54.183.206.9
country_id: 6252001
description:
[2025-02-07 14:12:14 +0100] info [webmaild] 54.183.206.9 - obiri@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 14:12:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  7 14:12:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
country_id: 1814991
description:
Feb  7 14:13:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.51.109
country_id: 1269750
description:
Feb  7 14:13:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.51.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
country_id: 1814991
description:
Feb  7 14:13:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 14:13:09 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:48301: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2025-02-07 14:13:13 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:51724: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-02-07 14:13:15 dovecot_plain authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:46596: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-02-07 14:13:19 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:47026: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.113.87
country_id: 732800
description:
Feb  7 14:12:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.113.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.113.87
country_id: 732800
description:
2025-02-07 14:12:37 dovecot_plain authenticator failed for (decally) [151.237.113.87]:54480: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
country_id: 2453866
description:
Feb  7 14:12:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
country_id: 1835841
description:
Feb  7 14:13:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-07 14:12:32 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:41136: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-02-07 14:12:44 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:7429: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
country_id: 390903
description:
Feb  7 14:14:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
country_id: 1835841
description:
Feb  7 14:14:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
country_id: 1819730
description:
Feb  7 14:14:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
country_id: 1269750
description:
Feb  7 14:14:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.89
country_id: 2017370
description:
2025-02-07 14:13:36 dovecot_plain authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:35258: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
country_id: 1819730
description:
2025-02-07 14:14:23 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:47253: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
country_id: 895949
description:
Feb  7 14:14:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-02-07 14:14:09 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:41708: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.37.17
country_id: 1880251
description:
Feb  7 14:13:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.37.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.57.60
country_id: 2510769
description:
Feb  7 14:13:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.57.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
country_id: 6252001
description:
2025-02-07 14:13:51 dovecot_login authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:35518: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.89
country_id: 2017370
description:
Feb  7 14:13:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.113.17.23
country_id: 1814991
description:
Feb  7 14:13:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.113.17.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Feb  7 14:13:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
country_id: 6252001
description:
2025-02-07 14:13:59 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:56694: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-07 14:14:25 dovecot_plain authenticator failed for ([41.216.84.18]) [41.216.84.18]:33411: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.37.17
country_id: 1880251
description:
2025-02-07 14:13:30 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:50539: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  7 14:13:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-02-07 14:13:49 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:40171: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
country_id: 390903
description:
2025-02-07 14:14:03 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:48516: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
country_id: 1819730
description:
Feb  7 14:14:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.121.152
country_id: 298795
description:
2025-02-07 14:13:48 dovecot_login authenticator failed for ([5.26.121.152]) [5.26.121.152]:40559: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.113.17.23
country_id: 1814991
description:
2025-02-07 14:13:38 dovecot_login authenticator failed for ([118.113.17.23]) [118.113.17.23]:52875: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-02-07 14:13:42 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:41282: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-07 14:13:43 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:25662: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
country_id: 6252001
description:
Feb  7 14:13:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.121.152
country_id: 298795
description:
Feb  7 14:13:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.121.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
country_id: 6252001
description:
Feb  7 14:13:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 14:14:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-02-07 14:14:51 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (prant) [81.225.30.107]:52943: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
country_id: 3469034
description:
Feb  7 14:14:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-07 14:15:21 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (relifirms) [92.244.126.105]:45882: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-02-07 14:14:29 dovecot_plain authenticator failed for ([180.188.253.150]) [180.188.253.150]:42580: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  7 14:14:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
country_id: 6251999
description:
Feb  7 14:14:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 54.183.206.9
country_id: 6252001
description:
[2025-02-07 14:15:19 +0100] info [webmaild] 54.183.206.9 - tsikpo@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  7 14:15:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
country_id: 1819730
description:
2025-02-07 14:14:29 dovecot_login authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:59990: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
country_id: 2017370
description:
Feb  7 14:14:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
country_id: 2661886
description:
Feb  7 14:14:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
country_id: 3469034
description:
2025-02-07 14:14:58 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:38431: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-07 14:14:31 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:56024: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
country_id: 2017370
description:
2025-02-07 14:14:36 dovecot_login authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:29590: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
country_id: 6251999
description:
2025-02-07 14:14:43 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:55144: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
country_id: 690791
description:
Feb  7 14:15:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
country_id: 690791
description:
2025-02-07 14:15:15 dovecot_plain authenticator failed for (chamy) [109.108.95.66]:33462: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.70
country_id: 1835841
description:
Feb  7 14:15:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.70
country_id: 1835841
description:
2025-02-07 14:15:36 dovecot_login authenticator failed for ([106.246.89.70]) [106.246.89.70]:50306: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
country_id: 1814991
description:
2025-02-07 14:15:47 dovecot_login authenticator failed for ([222.189.211.114]) [222.189.211.114]:57590: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2025-02-07 14:16:17 dovecot_login authenticator failed for ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:38826: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
country_id: 2017370
description:
Feb  7 14:15:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
country_id: 1835841
description:
Feb  7 14:16:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
country_id: 1835841
description:
2025-02-07 14:16:03 dovecot_login authenticator failed for ([220.120.224.227]) [220.120.224.227]:58026: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
country_id: 1814991
description:
Feb  7 14:16:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.121.61.198
country_id: 3017382
description:
Feb  7 14:16:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.121.61.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
country_id: 2017370
description:
2025-02-07 14:15:34 dovecot_plain authenticator failed for data.autofrant.ru (ashiferry) [151.248.116.230]:34482: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.189.211.114
country_id: 1814991
description:
Feb  7 14:15:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.189.211.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
country_id: 1814991
description:
2025-02-07 14:16:06 dovecot_login authenticator failed for ([45.117.10.134]) [45.117.10.134]:47058: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
country_id: 1814991
description:
Feb  7 14:16:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.55.253.100
country_id: 3865483
description:
[2025-02-07 14:17:19 +0100] info [webmaild] 190.55.253.100 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.121.214.105
country_id: 2017370
description:
2025-02-07 14:17:19 dovecot_plain authenticator failed for ([176.121.214.105]) [176.121.214.105]:60330: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
country_id: 1814991
description:
2025-02-07 14:16:45 dovecot_login authenticator failed for ([36.110.161.134]) [36.110.161.134]:35248: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.142.14
country_id: 1814991
description:
2025-02-07 14:17:00 dovecot_plain authenticator failed for ([39.164.142.14]) [39.164.142.14]:55493: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
country_id: 1814991
description:
2025-02-07 14:17:10 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:34167: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.45.67
country_id: 1880251
description:
47.128.45.67 - - [07/Feb/2025:14:17:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24257946 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/computer/?filtering=1&level=intermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.45.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
country_id: 1835841
description:
2025-02-07 14:17:14 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:50788: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-02-07 14:17:16 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:51480: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
country_id: 2017370
description:
2025-02-07 14:17:45 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:40782: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
country_id: 2510769
description:
2025-02-07 14:17:54 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:46629: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.179.58
country_id: 1814991
description:
2025-02-07 14:18:04 dovecot_plain authenticator failed for ([122.224.179.58]) [122.224.179.58]:34231: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
country_id: 1562822
description:
2025-02-07 14:17:30 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:42736: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-02-07 14:17:41 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:44740: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 14:17:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.235.231.48
country_id: 298795
description:
Feb  7 14:18:36 ait sshd[1835992]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.235.231.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.235.231.48
country_id: 298795
description:
Feb  7 14:18:36 ait sshd[1835992]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.235.231.48


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-19.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
country_id: 6252001
description:
2025-02-07 14:19:37 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1064: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.233
country_id: 1814991
description:
Feb  7 14:20:09 ait sshd[1836612]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
country_id: 1819730
description:
2025-02-07 14:20:13 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:23703: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.28.57.98
country_id: 1643084
description:
Feb  7 14:20:17 ait sshd[1836658]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.28.57.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
country_id: 3469034
description:
2025-02-07 14:20:17 dovecot_plain authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:34796: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.233
country_id: 1814991
description:
Feb  7 14:20:09 ait sshd[1836612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.233  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
country_id: 1835841
description:
2025-02-07 14:19:56 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:38696: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.28.57.98
country_id: 1643084
description:
Feb  7 14:20:17 ait sshd[1836658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.28.57.98


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 14:20:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.175.130.250
country_id: 617790
description:
Feb  7 14:20:35 ait sshd[1836730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.175.130.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.254.193
country_id: 3437598
description:
[2025-02-07 14:20:54 +0100] info [webmaild] 177.11.254.193 - info@lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.175.130.250
country_id: 617790
description:
Feb  7 14:20:35 ait sshd[1836730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.175.130.250


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
description:
Feb  7 14:20:39 ait sshd[1836730]: Connection reset by invalid user user 178.175.130.250 port 63222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.4.42.19
country_id: 3175395
description:
2025-02-07 14:20:48 dovecot_plain authenticator failed for (host-194-4-42-19.net.intranetwifi.it) [194.4.42.19]:41946: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-02-07 14:22:23 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:37206: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  7 14:21:51 ait sshd[1837265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 14:21:55 ait sshd[1837291]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 14:21:55 ait sshd[1837291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
country_id: 1814991
description:
2025-02-07 14:22:10 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:58318: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 159.224.217.66
country_id: 690791
description:
[2025-02-07 14:21:31 +0100] info [webmaild] 159.224.217.66 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  7 14:21:51 ait sshd[1837265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
country_id: 1835841
description:
Feb  7 14:22:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.137.198.228
country_id: 3996063
description:
Feb  7 14:22:29 ait sshd[1837541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.137.198.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-02-07 14:23:14 dovecot_plain authenticator failed for (couss) [154.144.243.93]:58814: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.235.231.48
country_id: 298795
description:
Feb  7 14:23:24 ait sshd[1837831]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.235.231.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.137.198.228
country_id: 3996063
description:
Feb  7 14:22:29 ait sshd[1837541]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.137.198.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
country_id: 1819730
description:
2025-02-07 14:22:58 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:16344: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.235.231.48
country_id: 298795
description:
Feb  7 14:23:24 ait sshd[1837831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.235.231.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.162
country_id: 6252001
description:
2025-02-07 14:23:24 dovecot_login authenticator failed for (ADMIN) [191.96.67.162]:51064: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-07 14:23:09 dovecot_plain authenticator failed for (hyria) [102.53.15.56]:34131: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.212.43.15
country_id: 3996063
description:
Feb  7 14:23:15 ait sshd[1837820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.212.43.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 14:23:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.212.43.15
country_id: 3996063
description:
Feb  7 14:23:15 ait sshd[1837820]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.212.43.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
country_id: 1814991
description:
2025-02-07 14:23:21 dovecot_plain authenticator failed for ([58.18.88.146]) [58.18.88.146]:49019: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.96.67.162
country_id: 6252001
description:
Feb  7 14:23:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.96.67.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
country_id: 3469034
description:
2025-02-07 14:23:56 dovecot_plain authenticator failed for (200-205-22-25.customer.tdatabrasil.net.br) [186.200.158.42]:50278: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-07 14:24:28 dovecot_plain authenticator failed for (prectrume) [109.166.70.166]:29046: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
country_id: 99237
description:
2025-02-07 14:23:36 dovecot_plain authenticator failed for (nonests) [65.20.128.78]:46912: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
country_id: 1835841
description:
2025-02-07 14:24:11 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:48610: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
country_id: 3175395
description:
2025-02-07 14:23:33 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:57506: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
country_id: 1835841
description:
2025-02-07 14:23:38 dovecot_plain authenticator failed for ([211.115.191.84]) [211.115.191.84]:57658: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
country_id: 1835841
description:
2025-02-07 14:23:51 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:48365: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
country_id: 1814991
description:
2025-02-07 14:25:04 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:38009: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.235.231.48
country_id: 298795
description:
Feb  7 14:24:43 ait sshd[1838190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.235.231.48


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.235.231.48
country_id: 298795
description:
Feb  7 14:24:46 ait sshd[1838190]: Failed password for invalid user alex from 176.235.231.48 port 18180 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.235.231.48
country_id: 298795
description:
Feb  7 14:24:43 ait sshd[1838190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.235.231.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
country_id: 732800
description:
2025-02-07 14:25:14 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:53211: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 14:24:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.28.57.98
country_id: 1643084
description:
Feb  7 14:24:30 ait sshd[1838142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.28.57.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.28.57.98
country_id: 1643084
description:
Feb  7 14:24:30 ait sshd[1838142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.28.57.98


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
country_id: 192950
description:
2025-02-07 14:25:31 dovecot_plain authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:54674: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
country_id: 1269750
description:
2025-02-07 14:25:43 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:49544: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.210.8.69
country_id: 3608932
description:
Feb  7 14:26:07 ait sshd[1838986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.210.8.69


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.214.175.213
country_id: 130758
description:
Feb  7 14:25:52 ait sshd[1838770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.214.175.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.214.175.213
country_id: 130758
description:
Feb  7 14:25:52 ait sshd[1838770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.214.175.213


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.28.57.98
country_id: 1643084
description:
Feb  7 14:26:00 ait sshd[1838794]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.28.57.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.28.57.98
country_id: 1643084
description:
Feb  7 14:26:00 ait sshd[1838794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.28.57.98


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2025-02-07 14:26:22 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:50092: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
country_id: 1880251
description:
2025-02-07 14:26:58 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:56459: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.247.72
country_id: 3469034
description:
[2025-02-07 14:27:03 +0100] info [webmaild] 177.67.247.72 - info@ait-ext.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.202.61.155
country_id: 2017370
description:
Feb  7 14:27:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.202.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-07 14:26:34 dovecot_login authenticator failed for ([147.235.97.158]) [147.235.97.158]:62681: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.101.162.43
country_id: 1861060
description:
2025-02-07 14:26:41 dovecot_plain authenticator failed for 157.101.162.43.static.zoot.jp [157.101.162.43]:34985: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.133
country_id: 1643084
description:
2025-02-07 14:26:48 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:45542: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2025-02-07 14:26:55 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:38235: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-07 14:27:08 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (cedges) [89.153.62.100]:37236: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-07 14:26:28 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:59647: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.103.193.170
country_id: 3469034
description:
[2025-02-07 14:26:32 +0100] info [webmaild] 187.103.193.170 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
country_id: 1269750
description:
Feb  7 14:26:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
country_id: 1269750
description:
2025-02-07 14:26:38 dovecot_plain authenticator failed for ([103.132.199.18]) [103.132.199.18]:54953: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
country_id: 6252001
description:
2025-02-07 14:26:35 dovecot_plain authenticator failed for (tafted) [160.72.153.14]:39810: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.137.198.228
country_id: 3996063
description:
Feb  7 14:26:29 ait sshd[1839259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.137.198.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.137.198.228
country_id: 3996063
description:
Feb  7 14:26:29 ait sshd[1839259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.137.198.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.61.155
country_id: 2017370
description:
2025-02-07 14:27:06 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:37747: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.137.198.228
country_id: 3996063
description:
Feb  7 14:28:00 ait sshd[1839773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.137.198.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.137.198.228
country_id: 3996063
description:
Feb  7 14:28:00 ait sshd[1839773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.137.198.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.212.43.15
country_id: 3996063
description:
Feb  7 14:27:47 ait sshd[1839647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.212.43.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.212.43.15
country_id: 3996063
description:
Feb  7 14:27:47 ait sshd[1839647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.212.43.15


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.210.8.69
country_id: 3608932
description:
Feb  7 14:28:41 ait sshd[1840020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.210.8.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
country_id: 1814991
description:
2025-02-07 14:28:43 dovecot_login authenticator failed for ([112.123.199.111]) [112.132.14.159]:60448: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
country_id: 2017370
description:
2025-02-07 14:29:01 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:20223: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.212.43.15
country_id: 3996063
description:
Feb  7 14:29:06 ait sshd[1840071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.212.43.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
country_id: 1835841
description:
2025-02-07 14:29:03 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:56520: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.212.43.15
country_id: 3996063
description:
Feb  7 14:29:06 ait sshd[1840071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.212.43.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
country_id: 1819730
description:
2025-02-07 14:29:15 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:29770: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
country_id: 2017370
description:
2025-02-07 14:29:51 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:37683: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 82.222.238.245
country_id: 298795
description:
[2025-02-07 14:29:53 +0100] info [webmaild] 82.222.238.245 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
country_id: 1814991
description:
2025-02-07 14:29:54 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:34422: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.210.8.69
country_id: 3608932
description:
Feb  7 14:29:58 ait sshd[1840305]: Failed password for invalid user dev from 181.210.8.69 port 44764 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-07 14:30:03 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:44137: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.214.175.213
country_id: 130758
description:
Feb  7 14:30:17 ait sshd[1840551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.214.175.213


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.210.8.69
country_id: 3608932
description:
Feb  7 14:29:57 ait sshd[1840305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.210.8.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-07 14:29:28 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:60690: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.81
country_id: 1814991
description:
2025-02-07 14:29:41 dovecot_plain authenticator failed for ([121.11.145.81]) [121.11.145.81]:32809: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
country_id: 2017370
description:
2025-02-07 14:30:07 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:45156: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.214.175.213
country_id: 130758
description:
Feb  7 14:30:17 ait sshd[1840551]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.214.175.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.89.4
country_id: 1269750
description:
2025-02-07 14:30:48 dovecot_login authenticator failed for (static-14.38.103.extranet.co.in) [111.92.89.4]:57971: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
country_id: 1814991
description:
2025-02-07 14:31:00 dovecot_login authenticator failed for ([183.220.247.88]) [183.220.247.88]:44668: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-07 14:31:20 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:34179: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-07 14:31:54 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:53685: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.195.225.182
country_id: 1668284
description:
2025-02-07 14:31:56 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:40118: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.214.175.213
country_id: 130758
description:
Feb  7 14:32:01 ait sshd[1841250]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.214.175.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.214.175.213
country_id: 130758
description:
Feb  7 14:32:01 ait sshd[1841250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.214.175.213


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-02-07 14:32:05 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:58435: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
country_id: 3175395
description:
2025-02-07 14:32:17 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:44166: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.215
country_id: 1880251
description:
47.128.16.215 - - [07/Feb/2025:14:32:23 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8271080 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=56" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
country_id: 1819730
description:
2025-02-07 14:31:36 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:41810: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.228
country_id: 1835841
description:
2025-02-07 14:31:37 dovecot_plain authenticator failed for ([114.108.126.228]) [114.108.126.228]:56528: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
country_id: 99237
description:
2025-02-07 14:32:26 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:48943: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-07 14:32:42 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:47392: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
country_id: 1814991
description:
2025-02-07 14:32:56 dovecot_plain authenticator failed for (ctw.webcas.net) [125.69.76.148]:55047: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
country_id: 1814991
description:
2025-02-07 14:33:08 dovecot_plain authenticator failed for ([123.139.116.184]) [123.139.116.184]:45866: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
country_id: 1819730
description:
2025-02-07 14:32:30 dovecot_login authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:36498: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
country_id: 1814991
description:
2025-02-07 14:32:37 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:34298: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.57
country_id: 597427
description:
2025-02-07 14:33:05 dovecot_login authenticator failed for (ADMIN) [194.32.122.57]:59244: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
country_id: 1814991
description:
2025-02-07 14:32:29 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:35870: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
country_id: 1835841
description:
2025-02-07 14:33:48 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:36087: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-34.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
country_id: 1835841
description:
2025-02-07 14:33:32 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:33362: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
country_id: 1814991
description:
2025-02-07 14:33:35 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:49960: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.213.240.6
country_id: 1814991
description:
2025-02-07 14:33:44 dovecot_plain authenticator failed for (6.240.213.139.adsl-pool.jlccptt.net.cn) [139.213.240.6]:56482: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.242.78
country_id: 1814991
description:
Feb  7 14:35:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.242.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.167.115.17
country_id: 6252001
description:
2025-02-07 14:34:27 dovecot_plain authenticator failed for (173-167-115-17-sfba.hfc.comcastbusiness.net) [173.167.115.17]:62488: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.237
country_id: 1880251
description:
47.128.98.237 - - [07/Feb/2025:14:34:32 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25055344 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C205%2C125%2C106&filter_course-language=121%2C79&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
country_id: 1269750
description:
Feb  7 14:34:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
country_id: 1269750
description:
2025-02-07 14:34:45 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:33268: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.10.175.77
country_id: 2635167
description:
Feb  7 14:34:35 ait sshd[1842239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.10.175.77  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
country_id: 617790
description:
Feb  7 14:35:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-07 14:35:13 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:43266: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
country_id: 1880251
description:
Feb  7 14:35:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-02-07 14:35:49 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:34096: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
country_id: 3017382
description:
Feb  7 14:36:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
country_id: 3017382
description:
2025-02-07 14:36:08 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (belly) [51.255.84.180]:34290: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.220.235.49
country_id: 3469034
description:
[2025-02-07 14:36:20 +0100] info [webmaild] 191.220.235.49 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.242.78
country_id: 1814991
description:
2025-02-07 14:35:28 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:54081: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.38.169
country_id: 1880251
description:
47.128.38.169 - - [07/Feb/2025:14:35:54 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6201260 HTTP/2.0" 302 0 www.ait-edu.us "https://www.ait-edu.us/application.php?no=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.38.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
country_id: 1814991
description:
Feb  7 14:36:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
country_id: 1814991
description:
2025-02-07 14:36:05 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:33544: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 14:36:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.98.87.187
country_id: 6252001
description:
2025-02-07 14:37:10 dovecot_login authenticator failed for (ADMIN) [172.98.87.187]:15073: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
country_id: 1269750
description:
Feb  7 14:37:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
country_id: 1269750
description:
2025-02-07 14:37:19 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:38942: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.67.14
country_id: 6252001
description:
2025-02-07 14:37:51 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:32826: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
country_id: 1668284
description:
Feb  7 14:38:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
country_id: 1835841
description:
2025-02-07 14:38:02 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:50008: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
country_id: 6252001
description:
2025-02-07 14:38:22 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:59326: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
country_id: 1835841
description:
Feb  7 14:38:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
country_id: 1668284
description:
2025-02-07 14:38:04 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:45990: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
country_id: 2077456
description:
2025-02-07 14:37:32 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:49310: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.67.14
country_id: 6252001
description:
Feb  7 14:37:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.67.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.194
country_id: 99237
description:
Feb  7 14:38:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.215.253
country_id: 6251999
description:
2025-02-07 14:38:19 dovecot_plain authenticator failed for ([199.192.215.253]) [199.192.215.253]:50827: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-02-07 14:38:19 dovecot_plain authenticator failed for (posspoodon) [65.20.148.194]:57783: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
country_id: 3017382
description:
2025-02-07 14:37:45 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:40254: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
country_id: 1814991
description:
Feb  7 14:38:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
country_id: 1814991
description:
2025-02-07 14:38:13 dovecot_plain authenticator failed for ([222.132.167.110]) [222.132.167.110]:59380: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
country_id: 6252001
description:
Feb  7 14:38:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
country_id: 2077456
description:
Feb  7 14:37:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
country_id: 3017382
description:
Feb  7 14:37:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
country_id: 6252001
description:
Feb  7 14:38:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-02-07 14:39:05 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:55454: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Feb  7 14:39:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Feb  7 14:39:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-02-07 14:39:20 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:50600: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
country_id: 6252001
description:
2025-02-07 14:38:30 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:33124: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.116
country_id: 1880251
description:
47.128.116.116 - - [07/Feb/2025:14:38:54 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19503099 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=90&id=70&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.116


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 149.202.42.249
country_id: 3017382
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:14-39.149.202.42.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
country_id: 3469034
description:
2025-02-07 14:40:58 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:50503: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
country_id: 1835841
description:
Feb  7 14:41:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
country_id: 895949
description:
2025-02-07 14:40:37 dovecot_plain authenticator failed for ([165.56.11.206]) [165.56.11.206]:34989: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  7 14:40:59 ait sshd[1844703]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
country_id: 1819730
description:
Feb  7 14:41:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
country_id: 1835841
description:
2025-02-07 14:41:11 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:50557: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  7 14:40:59 ait sshd[1844703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
country_id: 2017370
description:
Feb  7 14:41:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
country_id: 1819730
description:
2025-02-07 14:41:22 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:22764: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
country_id: 895949
description:
Feb  7 14:40:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
country_id: 3469034
description:
Feb  7 14:40:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
country_id: 2017370
description:
2025-02-07 14:41:12 dovecot_plain authenticator failed for (podephoism) [62.231.31.86]:60238: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.131.234
country_id: 1814991
description:
2025-02-07 14:42:25 dovecot_plain authenticator failed for ([183.233.131.234]) [183.233.131.234]:58967: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.86.114.43
country_id: 3469034
description:
2025-02-07 14:41:29 dovecot_plain authenticator failed for (colegioarnaldo241.static.host.gvt.net.br) [201.86.114.43]:52507: 535 Incorrect authentication data


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.230.18.52
country_id: 1880251
domain: ait.university
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:14-41.52.230.18.52||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.96.151.110
country_id: 1814991
description:
Feb  7 14:42:09 ait sshd[1845298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.96.151.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
country_id: 1814991
description:
Feb  7 14:42:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
country_id: 2403846
description:
2025-02-07 14:42:06 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:55806: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.131.234
country_id: 1814991
description:
Feb  7 14:42:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.131.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.230.18.52
country_id: 1880251
domain: ait.university
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/json.php||SC:/home/titlemas/public_html/ait.university/wp-content


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:14-41.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
country_id: 2403846
description:
Feb  7 14:42:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.19.124.20
country_id: 2017370
description:
[2025-02-07 14:41:29 +0100] info [webmaild] 195.19.124.20 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.96.151.110
country_id: 1814991
description:
Feb  7 14:42:09 ait sshd[1845298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.96.151.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
country_id: 1814991
description:
2025-02-07 14:42:24 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:43185: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


