# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
country_id: 1835841
description:
Feb  6 04:01:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  6 04:01:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-06 04:01:59 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:38146: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.115
country_id: 1819730
description:
2025-02-06 04:02:00 dovecot_plain authenticator failed for (m121-202-152-115.smartone.com) [121.202.152.115]:34420: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.211.125
country_id: 1814991
description:
Feb  6 04:01:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.211.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
country_id: 6251999
description:
Feb  6 04:01:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.38.99
country_id: 1880251
description:
47.128.38.99 - - [06/Feb/2025:04:01:28 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16039828" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.38.99


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.51.57.136
country_id: 2464461
description:
[2025-02-06 04:01:42 +0100] info [webmaild] 165.51.57.136 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
country_id: 2510769
description:
Feb  6 04:01:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
country_id: 6252001
description:
Feb  6 04:01:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
country_id: 1880251
description:
2025-02-06 04:01:47 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:39014: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
country_id: 6252001
description:
Feb  6 04:01:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.102.188.188
country_id: 1668284
description:
2025-02-06 04:01:49 dovecot_plain authenticator failed for (59-102-188-188.nty.dynamic.tbcnet.net.tw) [59.102.188.188]:38444: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
country_id: 3996063
description:
2025-02-06 04:02:02 dovecot_plain authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:38092: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.248.237.221
country_id: 1819730
description:
Feb  6 04:01:11 ait sshd[961046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 173.248.237.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
country_id: 1814991
description:
2025-02-06 04:01:32 dovecot_plain authenticator failed for ([111.53.52.116]) [111.53.52.116]:59524: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-02-06 04:01:45 dovecot_plain authenticator failed for ([82.193.122.91]) [82.193.122.91]:52092: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
country_id: 1814991
description:
Feb  6 04:01:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
country_id: 2403846
description:
2025-02-06 04:01:47 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:37528: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
country_id: 1819730
description:
Feb  6 04:01:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
country_id: 3469034
description:
2025-02-06 04:01:55 dovecot_plain authenticator failed for 179-236-213-190.user.veloxzone.com.br [179.236.213.190]:34260: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.213.240.6
country_id: 1814991
description:
Feb  6 04:01:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.213.240.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.211.125
country_id: 1814991
description:
2025-02-06 04:02:01 dovecot_plain authenticator failed for ([113.64.211.125]) [113.64.211.125]:52890: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.38
country_id: 1668284
description:
2025-02-06 04:01:20 dovecot_plain authenticator failed for 111-70-6-38.emome-ip.hinet.net [111.70.6.38]:44616: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
country_id: 1814991
description:
Feb  6 04:01:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.102.188.188
country_id: 1668284
description:
Feb  6 04:01:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.102.188.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-02-06 04:01:48 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:33604: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
country_id: 1819730
description:
2025-02-06 04:01:52 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:4130: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.232
country_id: 1269750
description:
2025-02-06 04:01:55 dovecot_plain authenticator failed for (abts-ap-dynamic-232.205.169.122.airtelbroadband.in) [122.169.205.232]:59595: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 04:01:05 ait sshd[960978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
country_id: 1835841
description:
Feb  6 04:01:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.33.44.158
country_id: 798549
description:
Feb  6 04:01:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.33.44.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2025-02-06 04:01:43 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:39096: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
country_id: 1819730
description:
2025-02-06 04:01:54 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:39526: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
country_id: 1814991
description:
Feb  6 04:02:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
country_id: 1835841
description:
2025-02-06 04:02:17 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:42098: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.21.65
country_id: 1880251
description:
47.128.21.65 - - [06/Feb/2025:04:02:38 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21535411 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?duration=short%2Cmedium&filter_course-language=121&filtering=1&instructor=2&level=intermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.21.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 04:02:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.201.78.253
country_id: 3469034
description:
Feb  6 04:02:05 ait sshd[961363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.201.78.253


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
country_id: 1835841
description:
Feb  6 04:02:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
country_id: 1819730
description:
2025-02-06 04:02:25 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:25786: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.129.200.113
country_id: 2077456
description:
Feb  6 04:02:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.129.200.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Feb  6 04:02:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
country_id: 1814991
description:
2025-02-06 04:02:08 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:34351: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
country_id: 6252001
description:
Feb  6 04:02:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.111.127
country_id: 294640
description:
2025-02-06 04:02:04 dovecot_plain authenticator failed for ([212.90.111.127]) [212.90.111.127]:32840: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
country_id: 1814991
description:
2025-02-06 04:02:06 dovecot_plain authenticator failed for ([222.170.255.146]) [222.170.255.146]:58818: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.111.127
country_id: 294640
description:
Feb  6 04:02:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.111.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
country_id: 3469034
description:
2025-02-06 04:02:10 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:9977: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.15.101.6
country_id: 3469034
description:
Feb  6 04:02:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.15.101.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.60.186
country_id: 1819730
description:
Feb  6 04:02:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.60.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
country_id: 1814991
description:
2025-02-06 04:02:03 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:48386: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.201.78.253
country_id: 3469034
description:
Feb  6 04:02:05 ait sshd[961363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.201.78.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.200.113
country_id: 2077456
description:
2025-02-06 04:02:06 dovecot_plain authenticator failed for (115-129-200-113.tpgi.com.au) [115.129.200.113]:60742: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.207
country_id: 3865483
description:
Feb  6 04:02:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-06 04:02:10 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:57252: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.190
country_id: 1269750
description:
2025-02-06 04:02:13 dovecot_plain authenticator failed for ([122.187.229.190]) [122.187.229.190]:52284: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-02-06 04:02:15 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:36238: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
country_id: 1835841
description:
2025-02-06 04:02:20 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:43168: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.190
country_id: 1269750
description:
Feb  6 04:02:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.173.106.95
country_id: 2921044
description:
Feb  6 04:02:02 ait sshd[961339]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.173.106.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.173.106.95
country_id: 2921044
description:
Feb  6 04:02:02 ait sshd[961339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.173.106.95  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
country_id: 3469034
description:
Feb  6 04:02:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.248.237.221
country_id: 1819730
description:
Feb  6 04:02:40 ait sshd[961671]: Failed password for invalid user mdom from 173.248.237.221 port 52444 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.146
country_id: 1814991
description:
Feb  6 04:02:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.101.6
country_id: 3469034
description:
2025-02-06 04:02:30 dovecot_plain authenticator failed for ([190.15.101.6]) [190.15.101.6]:32973: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.207
country_id: 3865483
description:
2025-02-06 04:02:09 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:42283: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
country_id: 1835841
description:
Feb  6 04:02:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.121.70.15
country_id: 3469034
description:
[2025-02-06 04:02:05 +0100] info [webmaild] 168.121.70.15 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-02-06 04:02:06 dovecot_plain authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:59401: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 209.45.57.186
country_id: 3932488
description:
[2025-02-06 04:02:36 +0100] info [webmaild] 209.45.57.186 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.212.39.199
country_id: 1861060
description:
Feb  6 04:02:40 ait sshd[961676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.212.39.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 04:02:06 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:39554: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 04:02:27 ait sshd[961610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.248.237.221
country_id: 1819730
description:
Feb  6 04:02:38 ait sshd[961671]: pam_imunify(sshd:auth): [IM360_RBL] The IP 173.248.237.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 173.248.237.221
country_id: 1819730
description:
Feb  6 04:02:38 ait sshd[961671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.248.237.221


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
country_id: 3017382
description:
Feb  6 04:02:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
country_id: 1819730
description:
Feb  6 04:02:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-02-06 04:02:04 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:33438: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 04:02:30 ait sshd[961624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
country_id: 1835841
description:
Feb  6 04:03:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
country_id: 1835841
description:
Feb  6 04:03:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2025-02-06 04:03:05 dovecot_login authenticator failed for ([220.122.115.9]) [220.122.115.9]:35462: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.201.78.253
country_id: 3469034
description:
Feb  6 04:03:32 ait sshd[961957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.201.78.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.201.78.253
country_id: 3469034
description:
Feb  6 04:03:32 ait sshd[961957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.201.78.253


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 04:03:55 ait sshd[962205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2025-02-06 04:03:21 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:55932: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.88.132
country_id: 3469034
description:
[2025-02-06 04:03:47 +0100] info [webmaild] 45.160.88.132 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 04:04:27 ait sshd[962462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
country_id: 3175395
description:
Feb  6 04:04:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.222.231
country_id: 3469034
description:
[2025-02-06 04:04:21 +0100] info [webmaild] 138.117.222.231 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.7.225.113
country_id: 3508796
description:
Feb  6 04:04:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.7.225.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.92.19
country_id: 1512440
description:
[2025-02-06 04:04:40 +0100] info [webmaild] 213.230.92.19 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
country_id: 1668284
description:
2025-02-06 04:04:11 dovecot_login authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:37315: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
country_id: 1819730
description:
Feb  6 04:04:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
country_id: 1819730
description:
2025-02-06 04:04:24 dovecot_login authenticator failed for ([116.92.208.12]) [116.92.208.12]:35372: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.7.225.113
country_id: 3508796
description:
2025-02-06 04:04:28 dovecot_plain authenticator failed for (113.225.7.186.f.dyn.claro.net.do) [186.7.225.113]:46950: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-02-06 04:04:31 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (drosite) [188.219.104.210]:49299: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.78
country_id: 1269750
description:
Feb  6 04:04:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
country_id: 1269750
description:
2025-02-06 04:04:19 dovecot_plain authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:47757: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.212.39.199
country_id: 1861060
description:
Feb  6 04:04:06 ait sshd[962391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.212.39.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
country_id: 1668284
description:
Feb  6 04:04:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
country_id: 1814991
description:
2025-02-06 04:05:14 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:48790: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.239.186
country_id: 1814991
description:
Feb  6 04:05:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.239.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.162.13.69
country_id: 1282988
description:
[2025-02-06 04:05:05 +0100] info [webmaild] 103.162.13.69 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
country_id: 1814991
description:
Feb  6 04:05:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.239.186
country_id: 1814991
description:
2025-02-06 04:05:27 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:34807: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
country_id: 1562822
description:
Feb  6 04:05:32 ait sshd[962984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
country_id: 1814991
description:
2025-02-06 04:06:05 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:44306: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.243.251
country_id: 3469034
description:
[2025-02-06 04:06:10 +0100] info [webmaild] 45.173.243.251 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
country_id: 3175395
description:
Feb  6 04:06:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-02-06 04:06:18 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:34432: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.45.49.88
country_id: 3469034
description:
[2025-02-06 04:06:45 +0100] info [webmaild] 177.45.49.88 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
country_id: 1814991
description:
Feb  6 04:06:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.226.4.27
country_id: 2464461
description:
Feb  6 04:07:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.226.4.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  6 04:07:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
country_id: 1835841
description:
Feb  6 04:07:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.99.54
country_id: 6252001
description:
Feb  6 04:07:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.38.188
country_id: 3469034
description:
[2025-02-06 04:07:08 +0100] info [webmaild] 177.54.38.188 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.64.254
country_id: 3469034
description:
[2025-02-06 04:07:40 +0100] info [webmaild] 168.232.64.254 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.76.78.139
country_id: 3469034
description:
[2025-02-06 04:08:58 +0100] info [webmaild] 177.76.78.139 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
country_id: 3686110
description:
Feb  6 04:08:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 04:08:35 ait sshd[963950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.99.54
country_id: 6252001
description:
Feb  6 04:08:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  6 04:08:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.123.208.246
country_id: 6252001
description:
Feb  6 04:08:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.123.208.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 04:10:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.231.107
country_id: 3469034
description:
[2025-02-06 04:09:35 +0100] info [webmaild] 177.55.231.107 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.155.46.119
country_id: 3686110
description:
[2025-02-06 04:09:39 +0100] info [webmaild] 186.155.46.119 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 04:09:41 ait sshd[964544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 04:09:41 ait sshd[964544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.128.68.177
country_id: 3865483
description:
2025-02-06 04:09:13 dovecot_plain authenticator failed for (localhost) [186.128.68.177]:1346: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 04:09:41 ait sshd[964546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
country_id: 1819730
description:
2025-02-06 04:10:36 dovecot_login authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:6973: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
country_id: 1668284
description:
Feb  6 04:10:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.232.231.46
country_id: 3469034
description:
[2025-02-06 04:10:09 +0100] info [webmaild] 45.232.231.46 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
country_id: 1814991
description:
Feb  6 04:10:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
country_id: 2017370
description:
Feb  6 04:10:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
country_id: 1814991
description:
2025-02-06 04:10:20 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:47395: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
country_id: 1819730
description:
Feb  6 04:10:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
country_id: 1210997
description:
Feb  6 04:10:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  6 04:10:05 ait sshd[964903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
country_id: 1210997
description:
2025-02-06 04:10:49 dovecot_login authenticator failed for (host-130-35-103-103.xlinkbd.net) [103.103.35.130]:47702: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
country_id: 2017370
description:
2025-02-06 04:10:39 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:41184: 535 Incorrect authentication data (set_id=dm)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
country_id: 2661886
description:
2025-02-06 04:11:49 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com (omprinves) [46.162.74.47]:56990: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
country_id: 1668284
description:
2025-02-06 04:11:01 dovecot_login authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:40514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.90.228.160
country_id: 3469034
description:
[2025-02-06 04:11:26 +0100] info [webmaild] 179.90.228.160 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
country_id: 2661886
description:
Feb  6 04:11:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.201.247.173
country_id: 690791
description:
[2025-02-06 04:12:47 +0100] info [webmaild] 91.201.247.173 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.190.76.241
country_id: 3469034
description:
[2025-02-06 04:12:16 +0100] info [webmaild] 38.190.76.241 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.194
country_id: 99237
description:
Feb  6 04:12:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 04:12:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-02-06 04:12:47 dovecot_plain authenticator failed for (cemia) [65.20.148.194]:51149: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
country_id: 1835841
description:
Feb  6 04:13:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.94.80.174
country_id: 3469034
description:
[2025-02-06 04:12:02 +0100] info [webmaild] 187.94.80.174 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-06 04:13:46 dovecot_plain authenticator failed for (string) [88.87.84.104]:56360: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-02-06 04:13:02 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:40298: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.178
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/data1/images/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  6 04:13:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-06 04:13:12 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:59940: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 04:13:52 ait sshd[965976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
country_id: 2017370
description:
Feb  6 04:13:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
country_id: 2017370
description:
2025-02-06 04:14:13 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:50708: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
country_id: 2623032
description:
Feb  6 04:14:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.18.247
country_id: 3932488
description:
[2025-02-06 04:14:40 +0100] info [webmaild] 38.25.18.247 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Feb  6 04:14:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 04:14:51 ait sshd[966395]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.104.137.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-02-06 04:14:52 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:32812: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
country_id: 2623032
description:
2025-02-06 04:14:28 dovecot_plain authenticator failed for (suprockys) [2.110.10.192]:44974: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
country_id: 1819730
description:
Feb  6 04:14:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 04:14:51 ait sshd[966395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.104.137.177  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
country_id: 1819730
description:
2025-02-06 04:14:52 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:41073: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.22.130.22
country_id: 1814991
description:
Feb  6 04:14:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.22.130.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
country_id: 1814991
description:
Feb  6 04:14:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
country_id: 6252001
description:
Feb  6 04:14:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.141.246.132
country_id: 3996063
description:
[2025-02-06 04:14:51 +0100] info [webmaild] 192.141.246.132 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.101.77
country_id: 1814991
description:
2025-02-06 04:14:38 dovecot_plain authenticator failed for ([112.26.101.77]) [112.26.101.77]:44565: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-06 04:14:43 dovecot_plain authenticator failed for (nerele) [102.53.15.56]:41660: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.226.184.170
country_id: 3469034
description:
[2025-02-06 04:14:04 +0100] info [webmaild] 186.226.184.170 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.22.130.22
country_id: 1814991
description:
2025-02-06 04:14:04 dovecot_plain authenticator failed for ([210.22.130.22]) [210.22.130.22]:58667: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
country_id: 2017370
description:
Feb  6 04:14:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.113.61.126
country_id: 298795
description:
Feb  6 04:14:17 ait sshd[966286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.113.61.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.133.26.153
country_id: 3439705
description:
[2025-02-06 04:15:15 +0100] info [webmaild] 190.133.26.153 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
country_id: 2017370
description:
Feb  6 04:15:24 ait sshd[966746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
country_id: 2077456
description:
Feb  6 04:15:31 ait sshd[966757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
country_id: 2510769
description:
2025-02-06 04:15:35 dovecot_plain authenticator failed for ([91.126.196.67]) [91.126.196.67]:52290: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
country_id: 2077456
description:
Feb  6 04:15:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-02-06 04:15:07 dovecot_plain authenticator failed for ([113.193.187.154]) [113.193.187.154]:37348: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 04:15:25 ait sshd[966748]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.63.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
country_id: 2510769
description:
Feb  6 04:15:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 04:15:25 ait sshd[966748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.63.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-02-06 04:15:55 dovecot_plain authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:37614: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-02-06 04:16:56 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:40554: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
country_id: 99237
description:
2025-02-06 04:16:10 dovecot_plain authenticator failed for (undid) [65.20.128.78]:55810: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.100.255
country_id: 3469034
description:
[2025-02-06 04:16:34 +0100] info [webmaild] 186.235.100.255 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
country_id: 1814991
description:
Feb  6 04:16:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
country_id: 99237
description:
Feb  6 04:16:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.88.175.185
country_id: 298795
description:
[2025-02-06 04:17:15 +0100] info [webmaild] 176.88.175.185 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  6 04:17:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-06 04:17:06 dovecot_login authenticator failed for ([121.141.194.159]) [121.141.194.159]:57164: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.21.13.147
country_id: 3469034
description:
[2025-02-06 04:17:11 +0100] info [webmaild] 187.21.13.147 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 8.242.169.27
country_id: 3686110
description:
[2025-02-06 04:17:47 +0100] info [webmaild] 8.242.169.27 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.7.109.160
country_id: 6252001
description:
Feb  6 04:17:12 ait sshd[967360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.7.109.160  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
country_id: 1819730
description:
Feb  6 04:18:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
country_id: 1819730
description:
2025-02-06 04:18:22 dovecot_login authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:25877: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.22.55
country_id: 3469034
description:
Feb  6 04:18:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.22.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
country_id: 3469034
description:
2025-02-06 04:18:44 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:51793: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
country_id: 2264397
description:
Feb  6 04:18:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-06 04:18:54 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:54682: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
country_id: 1835841
description:
Feb  6 04:18:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
country_id: 1835841
description:
2025-02-06 04:18:08 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:48220: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 04:19:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.15.8
country_id: 3469034
description:
[2025-02-06 04:19:04 +0100] info [webmaild] 179.108.15.8 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 04:19:27 ait sshd[967937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.239.165.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.183.152.73
country_id: 3469034
description:
[2025-02-06 04:19:42 +0100] info [webmaild] 179.183.152.73 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.124.1.113
country_id: 2245662
description:
[2025-02-06 04:19:57 +0100] info [webmaild] 154.124.1.113 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 04:19:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
country_id: 2661886
description:
2025-02-06 04:20:32 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (lariang) [217.215.254.115]:49634: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
country_id: 6252001
description:
2025-02-06 04:20:58 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:55075: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.89.195
country_id: 1814991
description:
2025-02-06 04:21:00 dovecot_plain authenticator failed for ([183.246.89.195]) [183.246.89.195]:42954: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 04:20:26 ait sshd[968506]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.174.201.124
country_id: 2017370
description:
[2025-02-06 04:20:28 +0100] info [webmaild] 85.174.201.124 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-02-06 04:20:42 dovecot_plain authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:54028: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
country_id: 6252001
description:
Feb  6 04:20:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 04:20:24 ait sshd[968500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.53.71
country_id: 1880251
description:
47.128.53.71 - - [06/Feb/2025:04:20:24 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 mail.ait-edu.us "https://mail.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18641539" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.53.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.246.89.195
country_id: 1814991
description:
Feb  6 04:20:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.246.89.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.148.191
country_id: 2661886
description:
Feb  6 04:20:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.148.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 04:20:24 ait sshd[968500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 04:20:26 ait sshd[968506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
country_id: 2661886
description:
Feb  6 04:20:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
country_id: 99237
description:
Feb  6 04:20:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
country_id: 1668284
description:
Feb  6 04:20:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
country_id: 99237
description:
2025-02-06 04:20:40 dovecot_plain authenticator failed for (asted) [65.20.200.71]:37122: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.148.191
country_id: 2661886
description:
2025-02-06 04:20:58 dovecot_plain authenticator failed for c188-148-148-191.bredband.tele2.se (oblatens) [188.148.148.191]:48231: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.138.162
country_id: 1168579
description:
Feb  6 04:21:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.138.162
country_id: 1168579
description:
2025-02-06 04:21:35 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:42416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
country_id: 2017370
description:
Feb  6 04:21:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2025-02-06 04:21:37 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:36652: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 04:21:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.180.33
country_id: 1814991
description:
Feb  6 04:21:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.180.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2025-02-06 04:21:56 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:44806: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.40.75
country_id: 3469034
description:
[2025-02-06 04:21:37 +0100] info [webmaild] 170.80.40.75 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
country_id: 2017370
description:
Feb  6 04:21:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.180.33
country_id: 1814991
description:
2025-02-06 04:21:20 dovecot_plain authenticator failed for ([218.14.180.33]) [218.14.180.33]:44597: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.80.126.128
country_id: 3469034
description:
[2025-02-06 04:22:28 +0100] info [webmaild] 200.80.126.128 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.98.236
country_id: 3469034
description:
[2025-02-06 04:22:13 +0100] info [webmaild] 187.62.98.236 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-02-06 04:22:51 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:64335: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2025-02-06 04:22:56 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:59796: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
country_id: 2017370
description:
Feb  6 04:22:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.118.53
country_id: 3865483
description:
Feb  6 04:22:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.118.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-02-06 04:22:12 dovecot_plain authenticator failed for ([167.250.118.53]) [167.250.118.53]:56442: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
country_id: 2017370
description:
2025-02-06 04:22:22 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:60188: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.250.78
country_id: 290557
description:
Feb  6 04:22:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.250.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
country_id: 1835841
description:
Feb  6 04:22:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 164.68.105.226
country_id: 3017382
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-22.164.68.105.226


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.66.11
country_id: 1210997
description:
[2025-02-06 04:23:00 +0100] info [webmaild] 182.48.66.11 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
country_id: 1168579
description:
Feb  6 04:23:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
country_id: 1168579
description:
2025-02-06 04:23:14 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:35056: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.3.140.29
country_id: 1814991
description:
2025-02-06 04:23:31 dovecot_plain authenticator failed for ([106.3.140.29]) [106.3.140.29]:33028: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 04:23:02 ait sshd[969120]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 04:23:02 ait sshd[969120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.210
country_id: 1814991
description:
Feb  6 04:23:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.96.160.30
country_id: 1814991
description:
2025-02-06 04:23:06 dovecot_login authenticator failed for ([211.96.160.30]) [211.96.160.30]:55925: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.96.160.30
country_id: 1814991
description:
Feb  6 04:23:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.96.160.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.210
country_id: 1814991
description:
2025-02-06 04:23:07 dovecot_plain authenticator failed for ([61.185.226.210]) [61.185.226.210]:50096: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.3.140.29
country_id: 1814991
description:
Feb  6 04:23:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.3.140.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.158.59.155
country_id: 3469034
description:
[2025-02-06 04:24:04 +0100] info [webmaild] 201.158.59.155 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.125.201
country_id: 1880251
description:
47.128.125.201 - - [06/Feb/2025:04:24:24 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 ait-edu.us "https://ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9614119" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.125.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.87.237.246
country_id: 3469034
description:
[2025-02-06 04:24:37 +0100] info [webmaild] 201.87.237.246 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.70.111
country_id: 99237
description:
[2025-02-06 04:24:56 +0100] info [webmaild] 37.77.70.111 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.114.98.173
country_id: 298795
description:
[2025-02-06 04:25:28 +0100] info [webmaild] 93.114.98.173 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
country_id: 2658434
description:
Feb  6 04:25:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
country_id: 2658434
description:
2025-02-06 04:25:56 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:54987: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
country_id: 2661886
description:
Feb  6 04:26:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
country_id: 2661886
description:
2025-02-06 04:26:14 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:49934: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
country_id: 1512440
description:
Feb  6 04:26:28 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.200.154.39
country_id: 2921044
description:
Feb  6 04:26:45 ait sshd[970365]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.200.154.39 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.200.154.39
country_id: 2921044
description:
Feb  6 04:26:45 ait sshd[970365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.200.154.39


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 04:26:53 ait sshd[970369]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  6 04:26:08 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-06 04:26:10 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:33481: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-02-06 04:26:30 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:47168: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.188.95.192
country_id: 3625428
description:
[2025-02-06 04:26:42 +0100] info [webmaild] 186.188.95.192 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 04:26:53 ait sshd[970369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-06 04:27:07 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:50060: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.50.33
country_id: 3469034
description:
[2025-02-06 04:27:31 +0100] info [webmaild] 186.237.50.33 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  6 04:27:38 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-06 04:27:40 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:42387: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.86.36
country_id: 1835841
description:
2025-02-06 04:27:50 dovecot_plain authenticator failed for ([118.36.86.36]) [118.36.86.36]:41174: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.33
country_id: 2921044
domain: requisition.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Kaisu1||WPU:Kaisu1||RSV:6.65||T:APACHE||MV:04-27.204.10.194.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
country_id: 290557
description:
Feb  6 04:27:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-02-06 04:27:58 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:48779: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
country_id: 290557
description:
2025-02-06 04:28:01 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:55299: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.61.99
country_id: 3469034
description:
[2025-02-06 04:27:21 +0100] info [webmaild] 189.106.61.99 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
country_id: 298795
description:
Feb  6 04:28:01 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
country_id: 1835841
description:
Feb  6 04:28:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.181.1.239
country_id: 3469034
description:
[2025-02-06 04:28:04 +0100] info [webmaild] 177.181.1.239 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
country_id: 1835841
description:
2025-02-06 04:28:06 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:33671: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  6 04:28:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-06 04:28:11 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:52392: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2025-02-06 04:28:27 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:47824: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-06 04:29:02 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:60684: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
country_id: 298795
description:
2025-02-06 04:28:03 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:48040: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-02-06 04:28:05 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:41074: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.181.71
country_id: 2017370
description:
2025-02-06 04:28:39 dovecot_plain authenticator failed for ([89.23.181.71]) [89.23.181.71]:35256: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Feb  6 04:28:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
country_id: 1835841
description:
Feb  6 04:28:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
country_id: 3175395
description:
Feb  6 04:28:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
country_id: 3175395
description:
2025-02-06 04:28:14 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:55626: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
country_id: 1835841
description:
Feb  6 04:28:23 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
country_id: 1835841
description:
2025-02-06 04:28:25 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:38454: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  6 04:29:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
country_id: 1814991
description:
Feb  6 04:29:11 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.53
country_id: 2635167
description:
Feb  6 04:29:46 ait sshd[971223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.53


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.64
country_id: 1512440
description:
[2025-02-06 04:29:31 +0100] info [webmaild] 84.54.73.64 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 04:29:44 ait sshd[971219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
country_id: 732800
description:
Feb  6 04:29:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
country_id: 660013
description:
Feb  6 04:29:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 04:29:44 ait sshd[971219]: Invalid user grandjean.immobilien 2a00 from 122.51.104.242 port 49102


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.53
country_id: 2635167
description:
Feb  6 04:29:46 ait sshd[971223]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
country_id: 660013
description:
2025-02-06 04:29:45 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:57120: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
country_id: 1814991
description:
2025-02-06 04:29:13 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:44200: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.42.19
country_id: 3175395
description:
Feb  6 04:29:27 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.4.42.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.193.70
country_id: 1814991
description:
Feb  6 04:29:33 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.193.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
country_id: 732800
description:
2025-02-06 04:29:59 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:8783: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2025-02-06 04:29:35 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:51716: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 04:29:44 ait sshd[971219]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.216.72
country_id: 3374766
description:
Feb  6 04:30:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.216.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.24.138.130
country_id: 6252001
description:
2025-02-06 04:30:27 dovecot_login authenticator failed for syn-024-024-138-130.res.spectrum.com [24.24.138.130]:59210: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.22
country_id: 1814991
description:
Feb  6 04:30:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.22
country_id: 1814991
description:
2025-02-06 04:30:48 dovecot_login authenticator failed for ([122.228.225.22]) [122.228.225.22]:46209: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
country_id: 1814991
description:
2025-02-06 04:30:49 dovecot_login authenticator failed for ([45.117.10.134]) [45.117.10.134]:49220: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.115.173.11
country_id: 1269750
description:
Feb  6 04:31:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.115.173.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
country_id: 1036973
description:
Feb  6 04:30:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.172.159.18
country_id: 1269750
description:
Feb  6 04:30:19 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.172.159.18 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 04:30:33 ait sshd[971581]: Invalid user grandjean.immobilien 2a00 from 122.51.104.242 port 52090


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.107.106.65
country_id: 2017370
description:
[2025-02-06 04:30:37 +0100] info [webmaild] 217.107.106.65 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.66.1.177
country_id: 2542007
description:
[2025-02-06 04:30:05 +0100] info [webmaild] 105.66.1.177 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.241.60.71
country_id: 2017370
description:
[2025-02-06 04:30:07 +0100] info [webmaild] 94.241.60.71 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Feb  6 04:30:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-02-06 04:30:33 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:56785: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
country_id: 2661886
description:
Feb  6 04:30:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
country_id: 2661886
description:
2025-02-06 04:30:07 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:39098: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-02-06 04:30:08 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:35788: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.24.138.130
country_id: 6252001
description:
Feb  6 04:30:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.24.138.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 04:30:33 ait sshd[971581]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 04:30:33 ait sshd[971581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
country_id: 1814991
description:
2025-02-06 04:31:54 dovecot_login authenticator failed for ([58.51.122.230]) [58.51.122.230]:33294: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
country_id: 1269750
description:
Feb  6 04:31:55 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
country_id: 1835841
description:
Feb  6 04:31:26 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
country_id: 2017370
description:
Feb  6 04:31:41 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 04:31:15 dovecot_login authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:21847: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.191.106
country_id: 1861060
description:
Feb  6 04:31:35 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.191.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.191.106
country_id: 1861060
description:
2025-02-06 04:31:37 dovecot_login authenticator failed for ([180.7.191.106]) [180.7.191.106]:49548: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.225.4
country_id: 1269750
description:
Feb  6 04:31:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.225.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-02-06 04:31:45 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:40884: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
country_id: 1835841
description:
2025-02-06 04:31:20 dovecot_login authenticator failed for ([222.99.237.249]) [222.99.237.249]:54381: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
country_id: 690791
description:
2025-02-06 04:31:23 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (sultifet) [176.37.212.85]:45994: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.83.22
country_id: 294640
description:
2025-02-06 04:31:33 dovecot_login authenticator failed for (2-54-83-22.orange.net.il) [2.54.83.22]:52845: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.235.158
country_id: 6252001
description:
Feb  6 04:31:41 ait sshd[972217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.235.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-02-06 04:31:56 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:36140: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.225.12
country_id: 1861060
description:
Feb  6 04:31:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.225.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.99.237.249
country_id: 1835841
description:
Feb  6 04:31:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.99.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
country_id: 1269750
description:
2025-02-06 04:31:57 dovecot_login authenticator failed for ([103.59.134.177]) [103.59.134.177]:3679: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.235.158
country_id: 6252001
description:
Feb  6 04:31:41 ait sshd[972217]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.235.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Feb  6 04:31:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
country_id: 1819730
description:
Feb  6 04:31:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
country_id: 3017382
description:
Feb  6 04:31:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.225.4
country_id: 1269750
description:
2025-02-06 04:31:08 dovecot_login authenticator failed for ([203.129.225.4]) [203.129.225.4]:38250: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.83.22
country_id: 294640
description:
Feb  6 04:31:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.83.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 04:31:13 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
country_id: 690791
description:
Feb  6 04:31:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Feb  6 04:31:36 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
country_id: 2017370
description:
2025-02-06 04:31:43 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:46334: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
country_id: 1814991
description:
Feb  6 04:31:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-02-06 04:31:04 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:33118: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.225.12
country_id: 1861060
description:
2025-02-06 04:31:11 dovecot_login authenticator failed for p38012-obmd01.osaka.ocn.ne.jp [153.141.225.12]:47331: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
country_id: 1819730
description:
2025-02-06 04:31:56 dovecot_login authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:55707: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
country_id: 1835841
description:
2025-02-06 04:31:28 dovecot_login authenticator failed for ([118.218.10.21]) [118.218.10.21]:37888: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-02-06 04:31:38 dovecot_login authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:37430: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
country_id: 2077456
description:
Feb  6 04:32:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
country_id: 2017370
description:
Feb  6 04:32:51 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
country_id: 2017370
description:
2025-02-06 04:32:53 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:56344: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.34.167.177
country_id: 357994
description:
[2025-02-06 04:32:02 +0100] info [webmaild] 41.34.167.177 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.187.191.65
country_id: 1210997
description:
[2025-02-06 04:32:35 +0100] info [webmaild] 160.187.191.65 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.166.150.200
country_id: 3508796
description:
[2025-02-06 04:32:38 +0100] info [webmaild] 190.166.150.200 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
country_id: 2077456
description:
2025-02-06 04:32:45 dovecot_plain authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:44051: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.194.233
country_id: 3469034
description:
[2025-02-06 04:33:06 +0100] info [webmaild] 138.185.194.233 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.70.38
country_id: 1814991
description:
2025-02-06 04:33:27 dovecot_login authenticator failed for ([218.108.70.38]) [218.108.70.38]:44480: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  6 04:33:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.130.219.128
country_id: 1562822
description:
Feb  6 04:33:12 ait sshd[972595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.219.128  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.221.21
country_id: 1814991
description:
Feb  6 04:33:14 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.85
country_id: 1814991
description:
2025-02-06 04:33:32 dovecot_login authenticator failed for ([183.220.247.85]) [183.220.247.85]:44838: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-06 04:33:14 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:38140: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
country_id: 3175395
description:
2025-02-06 04:33:26 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:35396: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
country_id: 953987
description:
2025-02-06 04:33:46 dovecot_login authenticator failed for ([197.87.10.83]) [197.87.10.83]:53656: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
country_id: 953987
description:
Feb  6 04:33:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.219.128
country_id: 1562822
description:
Feb  6 04:33:12 ait sshd[972595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.130.219.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
country_id: 1814991
description:
2025-02-06 04:33:16 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:50928: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
country_id: 3175395
description:
Feb  6 04:33:24 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.70.38
country_id: 1814991
description:
Feb  6 04:33:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.70.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.85
country_id: 1814991
description:
Feb  6 04:33:30 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
country_id: 1835841
description:
Feb  6 04:34:39 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
country_id: 1522867
description:
Feb  6 04:34:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-02-06 04:34:27 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:33384: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
country_id: 1814991
description:
2025-02-06 04:34:46 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:57482: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.249.25.218
country_id: 3469034
description:
[2025-02-06 04:34:47 +0100] info [webmaild] 167.249.25.218 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
country_id: 1835841
description:
2025-02-06 04:34:41 dovecot_login authenticator failed for ([58.225.239.115]) [58.225.239.115]:54562: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
country_id: 1814991
description:
Feb  6 04:34:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
country_id: 1814991
description:
2025-02-06 04:35:03 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:47750: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
country_id: 3469034
description:
Feb  6 04:35:33 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
country_id: 1814991
description:
Feb  6 04:35:01 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.37.181
country_id: 6252001
description:
Feb  6 04:35:23 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.37.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 04:35:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  6 04:35:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
country_id: 1814991
description:
2025-02-06 04:35:42 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:33113: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.20
country_id: 1814991
description:
2025-02-06 04:35:57 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:34312: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.56.40
country_id: 3469034
description:
[2025-02-06 04:35:46 +0100] info [webmaild] 45.172.56.40 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.151.189.54
country_id: 2017370
description:
[2025-02-06 04:35:22 +0100] info [webmaild] 89.151.189.54 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-06 04:35:35 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:42076: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
country_id: 1835841
description:
Feb  6 04:35:37 ait sshd[973580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-06 04:35:54 dovecot_plain authenticator failed for ([178.178.222.55]) [178.178.222.55]:49618: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 04:35:44 ait sshd[973589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 04:35:44 ait sshd[973589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.37.181
country_id: 6252001
description:
2025-02-06 04:35:25 dovecot_plain authenticator failed for ([158.140.37.181]) [158.140.37.181]:57342: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
country_id: 1835841
description:
Feb  6 04:35:37 ait sshd[973580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.187.66.166
country_id: 1814991
description:
2025-02-06 04:35:50 dovecot_login authenticator failed for ([117.187.66.166]) [117.187.66.166]:38486: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.20
country_id: 1814991
description:
Feb  6 04:35:55 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.127.64
country_id: 3469034
description:
[2025-02-06 04:35:14 +0100] info [webmaild] 143.202.127.64 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
country_id: 1814991
description:
Feb  6 04:35:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.187.66.166
country_id: 1814991
description:
Feb  6 04:35:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.187.66.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.85.183
country_id: 1269750
description:
Feb  6 04:36:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.183.85.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 04:36:16 ait sshd[973900]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.183.209.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
country_id: 1814991
description:
Feb  6 04:36:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 04:36:46 ait sshd[973958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-36.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 04:36:16 ait sshd[973900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.183.209.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.85.183
country_id: 1269750
description:
2025-02-06 04:36:11 dovecot_login authenticator failed for ([68.183.85.183]) [68.183.85.183]:58722: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
country_id: 1814991
description:
2025-02-06 04:36:20 dovecot_login authenticator failed for ([60.216.37.11]) [60.216.37.11]:45482: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 04:36:46 ait sshd[973958]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.156.122
country_id: 1814991
description:
2025-02-06 04:37:39 dovecot_login authenticator failed for ([120.236.156.122]) [120.236.156.122]:50042: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
country_id: 6252001
description:
Feb  6 04:37:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.238
country_id: 1814991
description:
2025-02-06 04:38:00 dovecot_login authenticator failed for ([221.195.208.238]) [221.195.208.238]:49550: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.106
country_id: 1880251
description:
47.128.59.106 - - [06/Feb/2025:04:37:08 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13030472 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/170fe1/search/results?ip=52.167.144.235&limit=10&method=GET" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-06 04:37:38 dovecot_login authenticator failed for ([61.108.83.254]) [61.108.83.139]:41725: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
country_id: 3469034
description:
Feb  6 04:37:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
country_id: 3469034
description:
Feb  6 04:37:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.96.122.134
country_id: 3865483
description:
[2025-02-06 04:37:56 +0100] info [webmaild] 190.96.122.134 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
country_id: 1269750
description:
2025-02-06 04:37:55 dovecot_login authenticator failed for ([103.196.30.122]) [103.196.30.122]:54882: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
country_id: 6252001
description:
2025-02-06 04:37:56 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:35788: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.157.105
country_id: 3469034
description:
[2025-02-06 04:37:19 +0100] info [webmaild] 45.70.157.105 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
country_id: 1835841
description:
Feb  6 04:37:36 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
country_id: 1835841
description:
2025-02-06 04:37:36 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:50491: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.156.122
country_id: 1814991
description:
Feb  6 04:37:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.156.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.238
country_id: 1814991
description:
Feb  6 04:37:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.221.102.26
country_id: 953987
description:
[2025-02-06 04:38:00 +0100] info [webmaild] 197.221.102.26 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.184
country_id: 1668284
description:
2025-02-06 04:37:54 dovecot_login authenticator failed for 111-70-49-184.emome-ip.hinet.net [111.70.49.184]:33609: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-06 04:37:54 dovecot_login authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:46717: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
country_id: 1835841
description:
Feb  6 04:37:34 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
country_id: 3469034
description:
2025-02-06 04:37:46 dovecot_login authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:52730: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.184
country_id: 1668284
description:
Feb  6 04:37:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
country_id: 1269750
description:
Feb  6 04:37:53 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
country_id: 2017370
description:
Feb  6 04:38:07 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
country_id: 3175395
description:
2025-02-06 04:38:17 dovecot_login authenticator failed for ([2.194.38.121]) [2.194.38.121]:49990: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 04:38:30 ait sshd[974386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.35.129.86
country_id: 2017370
description:
[2025-02-06 04:38:31 +0100] info [webmaild] 185.35.129.86 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/data1/images/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
country_id: 2017370
description:
2025-02-06 04:38:09 dovecot_login authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:50900: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.194.38.121
country_id: 3175395
description:
Feb  6 04:38:15 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.194.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.170.20
country_id: 2017370
description:
2025-02-06 04:38:51 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:60114: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.167.139
country_id: 1269750
description:
Feb  6 04:38:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.167.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.167.139
country_id: 1269750
description:
2025-02-06 04:38:06 dovecot_plain authenticator failed for (abts-kk-static-139.167.166.122.airtelbroadband.in) [122.166.167.139]:38526: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.170.20
country_id: 2017370
description:
Feb  6 04:38:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.170.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
country_id: 1835841
description:
Feb  6 04:39:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.54.87
country_id: 1814991
description:
Feb  6 04:39:38 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.54.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-02-06 04:39:54 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:54792: 535 Incorrect authentication data (set_id=suvie)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/data1/images/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
country_id: 1835841
description:
2025-02-06 04:39:08 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:39176: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.54.87
country_id: 1814991
description:
2025-02-06 04:39:40 dovecot_plain authenticator failed for ([120.237.54.87]) [120.237.54.87]:59756: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 04:39:40 ait sshd[974781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 04:39:40 ait sshd[974781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
country_id: 1814991
description:
Feb  6 04:39:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
country_id: 2542007
description:
Feb  6 04:40:19 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 04:40:44 ait sshd[975191]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 04:40:22 ait sshd[975132]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Feb  6 04:40:32 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-06 04:40:34 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:60514: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.44.96.195
country_id: 690791
description:
[2025-02-06 04:40:37 +0100] info [webmaild] 194.44.96.195 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
country_id: 2017370
description:
Feb  6 04:40:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-02-06 04:40:59 dovecot_plain authenticator failed for (hounlin) [65.20.148.194]:53336: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.252.73.35
country_id: 298795
description:
[2025-02-06 04:40:02 +0100] info [webmaild] 212.252.73.35 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/data1/images/images/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 04:40:22 ait sshd[975132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
country_id: 2542007
description:
2025-02-06 04:40:21 dovecot_plain authenticator failed for (tweatic) [102.53.15.54]:40566: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.138.165.23
country_id: 3469034
description:
[2025-02-06 04:40:37 +0100] info [webmaild] 177.138.165.23 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 04:40:44 ait sshd[975191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-06 04:40:51 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:60752: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.194
country_id: 99237
description:
Feb  6 04:40:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 04:41:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 04:41:39 dovecot_login authenticator failed for ([1.242.165.148]) [1.242.165.148]:38770: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-06 04:41:49 dovecot_login authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:38173: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
country_id: 2017370
description:
Feb  6 04:41:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/data1/images/images/js/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.34.90.131
country_id: 3469034
description:
[2025-02-06 04:41:09 +0100] info [webmaild] 179.34.90.131 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
country_id: 1835841
description:
Feb  6 04:41:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.46.22
country_id: 1880251
description:
47.128.46.22 - - [06/Feb/2025:04:41:08 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23132462 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/291b9b?panel=logger" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
country_id: 2017370
description:
2025-02-06 04:41:51 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:5034: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-06 04:41:54 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:44924: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  6 04:41:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
country_id: 1835841
description:
2025-02-06 04:41:59 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:34062: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
country_id: 1814991
description:
2025-02-06 04:42:37 dovecot_login authenticator failed for ([111.39.206.23]) [111.39.206.23]:48781: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.56.111.87
country_id: 1814991
description:
Feb  6 04:42:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.56.111.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
country_id: 2077456
description:
2025-02-06 04:42:50 dovecot_login authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:33345: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
country_id: 6252001
description:
2025-02-06 04:42:06 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:33473: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.63.206
country_id: 1814991
description:
2025-02-06 04:42:08 dovecot_login authenticator failed for ([211.97.63.206]) [211.97.63.206]:60931: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 04:42:21 ait sshd[975835]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.123.116.93
country_id: 1814991
description:
Feb  6 04:42:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.123.116.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.123.116.93
country_id: 1814991
description:
2025-02-06 04:42:04 dovecot_plain authenticator failed for ([118.123.116.93]) [118.123.116.93]:58856: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
country_id: 1814991
description:
Feb  6 04:42:22 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
country_id: 1269750
description:
Feb  6 04:42:35 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.78.97
country_id: 3658394
description:
[2025-02-06 04:42:43 +0100] info [webmaild] 191.99.78.97 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.56.111.87
country_id: 1814991
description:
2025-02-06 04:42:49 dovecot_login authenticator failed for ([106.56.111.87]) [106.56.111.87]:45826: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.97.63.206
country_id: 1814991
description:
Feb  6 04:42:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.97.63.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-02-06 04:42:08 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:38694: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 04:42:21 ait sshd[975835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
country_id: 2750405
description:
2025-02-06 04:42:32 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:49488: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
country_id: 1814991
description:
Feb  6 04:42:35 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-02-06 04:42:36 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:56903: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
country_id: 1269750
description:
2025-02-06 04:42:37 dovecot_login authenticator failed for (nsg-corporate-95.243.187.122.airtel.in) [122.187.243.95]:36825: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.34.129.26
country_id: 3703430
description:
Feb  6 04:42:50 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.34.129.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.34.129.26
country_id: 3703430
description:
2025-02-06 04:42:52 dovecot_login authenticator failed for ([190.34.129.26]) [190.34.129.26]:55690: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
country_id: 2750405
description:
Feb  6 04:42:30 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
country_id: 6252001
description:
Feb  6 04:42:34 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
country_id: 6252001
description:
Feb  6 04:42:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Feb  6 04:42:11 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/data1/images/images/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.97.90.143
country_id: 1814991
description:
Feb  6 04:42:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.97.90.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.97.90.143
country_id: 1814991
description:
2025-02-06 04:43:00 dovecot_login authenticator failed for ([180.97.90.143]) [180.97.90.143]:56711: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
country_id: 1562822
description:
Feb  6 04:42:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
country_id: 1814991
description:
2025-02-06 04:42:24 dovecot_login authenticator failed for ([218.68.0.210]) [218.68.0.210]:51619: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
country_id: 2077456
description:
Feb  6 04:42:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
country_id: 1814991
description:
Feb  6 04:42:51 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-02-06 04:42:13 dovecot_login authenticator failed for syn-024-104-225-201.res.spectrum.com [24.104.225.201]:55997: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
country_id: 1814991
description:
2025-02-06 04:42:53 dovecot_login authenticator failed for ([124.132.61.213]) [124.132.61.213]:37376: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
country_id: 294640
description:
Feb  6 04:43:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-02-06 04:43:04 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:49028: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/data1/images/images/engine1/js/js/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.50.12.58
country_id: 3658394
description:
[2025-02-06 04:43:37 +0100] info [webmaild] 27.50.12.58 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 04:43:49 ait sshd[976324]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.188.139
country_id: 1814991
description:
2025-02-06 04:43:14 dovecot_login authenticator failed for ([220.248.188.139]) [220.248.188.139]:53820: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.5.35.206
country_id: 3895114
description:
[2025-02-06 04:43:06 +0100] info [webmaild] 190.5.35.206 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
country_id: 2017370
description:
Feb  6 04:43:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2025-02-06 04:43:32 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:50894: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
country_id: 617790
description:
2025-02-06 04:43:48 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:35790: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
country_id: 1814991
description:
2025-02-06 04:43:27 dovecot_login authenticator failed for ([221.195.208.171]) [221.195.208.171]:5142: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.188.139
country_id: 1814991
description:
Feb  6 04:43:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.188.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
country_id: 732800
description:
2025-02-06 04:43:22 dovecot_plain authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:38042: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
country_id: 1814991
description:
Feb  6 04:43:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
country_id: 2017370
description:
2025-02-06 04:43:04 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:55764: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.213.107
country_id: 1814991
description:
2025-02-06 04:43:39 dovecot_login authenticator failed for ([183.237.213.107]) [183.237.213.107]:46461: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.241.234
country_id: 1814991
description:
Feb  6 04:43:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.241.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-02-06 04:43:54 dovecot_login authenticator failed for ([210.22.130.22]) [58.246.241.234]:37023: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
country_id: 732800
description:
Feb  6 04:43:20 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.46.114.107
country_id: 3658394
description:
[2025-02-06 04:43:17 +0100] info [webmaild] 201.46.114.107 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.57.125
country_id: 1668284
description:
Feb  6 04:43:30 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.57.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.213.107
country_id: 1814991
description:
Feb  6 04:43:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.213.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
country_id: 617790
description:
Feb  6 04:43:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 04:43:49 ait sshd[976324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.237.145.18
country_id: 3469034
description:
2025-02-06 04:43:58 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:42193: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
country_id: 2245662
description:
Feb  6 04:44:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 04:44:01 ait sshd[976355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
country_id: 2017370
description:
2025-02-06 04:44:41 dovecot_login authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:55814: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
country_id: 1269750
description:
2025-02-06 04:44:48 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:32776: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.171.238
country_id: 1814991
description:
2025-02-06 04:44:56 dovecot_plain authenticator failed for ([124.115.171.238]) [124.115.171.238]:49905: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.171.238
country_id: 1814991
description:
Feb  6 04:44:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.171.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
country_id: 1835841
description:
Feb  6 04:45:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
country_id: 2328926
description:
2025-02-06 04:44:33 dovecot_login authenticator failed for ([197.211.47.66]) [197.211.47.66]:38675: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
country_id: 1269750
description:
Feb  6 04:44:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 04:44:47 ait sshd[976614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
country_id: 2245662
description:
2025-02-06 04:45:01 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:59617: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
country_id: 6252001
description:
2025-02-06 04:44:08 dovecot_plain authenticator failed for (dulacest) [96.239.87.6]:46158: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
country_id: 2328926
description:
Feb  6 04:44:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 04:44:47 ait sshd[976614]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 04:44:01 ait sshd[976355]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
country_id: 6252001
description:
Feb  6 04:44:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
country_id: 2017370
description:
Feb  6 04:44:39 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Feb  6 04:45:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
country_id: 6252001
description:
Feb  6 04:45:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
country_id: 1835841
description:
Feb  6 04:45:21 ait sshd[976806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
country_id: 1835841
description:
Feb  6 04:45:21 ait sshd[976806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.35.121
country_id: 3469034
description:
[2025-02-06 04:45:24 +0100] info [webmaild] 45.6.35.121 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 04:45:35 ait sshd[976965]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.106
country_id: 2635167
description:
Feb  6 04:45:56 ait sshd[977208]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.106
country_id: 2635167
description:
Feb  6 04:45:56 ait sshd[977208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.106


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.62.89
country_id: 3658394
description:
[2025-02-06 04:46:00 +0100] info [webmaild] 181.199.62.89 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-02-06 04:45:07 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:34490: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 04:45:35 ait sshd[976965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
country_id: 1835841
description:
2025-02-06 04:45:02 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:52864: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
country_id: 6252001
description:
2025-02-06 04:45:11 dovecot_login authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:51112: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.109.19
country_id: 3469034
description:
[2025-02-06 04:46:36 +0100] info [webmaild] 138.97.109.19 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
country_id: 1880251
description:
2025-02-06 04:46:39 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:33277: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/images/js/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
country_id: 1835841
description:
2025-02-06 04:46:08 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:48916: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-02-06 04:46:22 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:45435: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
country_id: 6251999
description:
Feb  6 04:46:24 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
country_id: 6251999
description:
2025-02-06 04:46:26 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:44277: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
country_id: 1835841
description:
Feb  6 04:46:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.160.78
country_id: 3469034
description:
[2025-02-06 04:46:06 +0100] info [webmaild] 170.254.160.78 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
country_id: 1655842
description:
Feb  6 04:46:20 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
country_id: 1880251
description:
Feb  6 04:46:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
country_id: 2017370
description:
2025-02-06 04:47:32 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:36723: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
country_id: 1814991
description:
2025-02-06 04:47:39 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:57728: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
country_id: 6252001
description:
Feb  6 04:47:51 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
country_id: 1814991
description:
Feb  6 04:47:55 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.210.10
country_id: 1814991
description:
Feb  6 04:47:28 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.210.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.22.46
country_id: 3469034
description:
2025-02-06 04:47:29 dovecot_plain authenticator failed for (189-108-97-55.customer.tdatabrasil.net.br) [187.93.22.46]:59157: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Feb  6 04:47:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.177.90.113
country_id: 2661886
description:
Feb  6 04:47:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.177.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.177.90.113
country_id: 2661886
description:
2025-02-06 04:47:56 dovecot_plain authenticator failed for c151-177-90-113.bredband.tele2.se (reroty) [151.177.90.113]:46030: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 04:47:45 ait sshd[977785]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/images/js/engine1/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
country_id: 6252001
description:
Feb  6 04:47:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
country_id: 2017370
description:
Feb  6 04:47:27 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
country_id: 1814991
description:
2025-02-06 04:47:30 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:47424: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 04:47:33 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:40434: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
country_id: 690791
description:
Feb  6 04:47:34 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 04:47:45 ait sshd[977785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.70.169
country_id: 1814991
description:
Feb  6 04:47:09 ait sshd[977532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.70.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
country_id: 6252001
description:
2025-02-06 04:47:20 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:58446: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
country_id: 2017370
description:
2025-02-06 04:47:29 dovecot_plain authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru [87.240.58.132]:58276: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
country_id: 3017382
description:
2025-02-06 04:47:39 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:38440: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.105
country_id: 1668284
description:
2025-02-06 04:47:43 dovecot_plain authenticator failed for 111-70-49-105.emome-ip.hinet.net [111.70.49.105]:53348: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
country_id: 1269750
description:
Feb  6 04:47:22 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.59.211.214
country_id: 3469034
description:
2025-02-06 04:47:23 dovecot_plain authenticator failed for ([201.59.211.214]) [201.59.211.214]:39186: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
country_id: 3017382
description:
Feb  6 04:47:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-06 04:47:45 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:27650: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.70.169
country_id: 1814991
description:
Feb  6 04:47:10 ait sshd[977532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.70.169  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
country_id: 1269750
description:
2025-02-06 04:47:24 dovecot_plain authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:42935: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-02-06 04:47:36 dovecot_plain authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:62939: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.240.115
country_id: 3469034
description:
[2025-02-06 04:47:50 +0100] info [webmaild] 138.219.240.115 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
country_id: 933860
description:
Feb  6 04:47:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-02-06 04:47:46 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:35318: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
country_id: 1814991
description:
2025-02-06 04:47:57 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:47261: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-06 04:48:00 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:53324: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.59.211.214
country_id: 3469034
description:
Feb  6 04:47:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.59.211.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
country_id: 2017370
description:
Feb  6 04:47:30 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 04:47:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
country_id: 1814991
description:
Feb  6 04:47:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-02-06 04:47:53 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:51464: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  6 04:47:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-06 04:48:35 dovecot_login authenticator failed for ([39.174.90.48]) [39.174.90.43]:45322: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.184
country_id: 1269750
description:
Feb  6 04:48:45 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
country_id: 1269750
description:
2025-02-06 04:48:46 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:37830: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-02-06 04:48:48 dovecot_plain authenticator failed for ([103.68.52.210]) [103.68.52.210]:48310: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
country_id: 6252001
description:
Feb  6 04:48:51 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
country_id: 1814991
description:
2025-02-06 04:48:50 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:54788: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
country_id: 2658434
description:
2025-02-06 04:48:56 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:47158: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 04:48:49 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:38057: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
country_id: 2510769
description:
Feb  6 04:48:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-02-06 04:48:59 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:44862: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.230
country_id: 1814991
description:
Feb  6 04:48:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
country_id: 732800
description:
2025-02-06 04:48:44 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:45739: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
country_id: 2017370
description:
Feb  6 04:48:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
country_id: 1814991
description:
2025-02-06 04:48:48 dovecot_plain authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:42660: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
country_id: 298795
description:
2025-02-06 04:48:51 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:39034: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.85.114
country_id: 3469034
description:
Feb  6 04:48:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.85.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
country_id: 1819730
description:
Feb  6 04:48:45 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
country_id: 3895114
description:
2025-02-06 04:48:47 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:44798: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  6 04:48:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2025-02-06 04:48:51 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:53094: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.43.143
country_id: 1269750
description:
Feb  6 04:48:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.113.43.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
country_id: 1814991
description:
Feb  6 04:48:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
country_id: 1814991
description:
Feb  6 04:49:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
country_id: 1269750
description:
Feb  6 04:48:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.152.103.134
country_id: 6252001
description:
2025-02-06 04:48:48 dovecot_plain authenticator failed for 134.sub-166-152-103.myvzw.com [166.152.103.134]:59414: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.159
country_id: 1668284
description:
2025-02-06 04:48:50 dovecot_plain authenticator failed for 111-70-1-159.emome-ip.hinet.net [111.70.1.159]:49351: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
country_id: 2658434
description:
Feb  6 04:48:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
country_id: 1814991
description:
Feb  6 04:48:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-06 04:48:58 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:41720: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
country_id: 1814991
description:
2025-02-06 04:48:59 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:45397: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-02-06 04:49:00 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:52629: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
country_id: 3017382
description:
2025-02-06 04:48:44 dovecot_plain authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:48278: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.1.159
country_id: 1668284
description:
Feb  6 04:48:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.1.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
country_id: 1210997
description:
2025-02-06 04:48:52 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:41122: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
country_id: 1814991
description:
Feb  6 04:49:01 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
country_id: 337996
description:
Feb  6 04:48:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
country_id: 1814991
description:
Feb  6 04:48:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
country_id: 2661886
description:
2025-02-06 04:49:01 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:54172: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
country_id: 3996063
description:
Feb  6 04:48:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 04:48:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
country_id: 1814991
description:
Feb  6 04:48:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
country_id: 1168579
description:
Feb  6 04:48:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
country_id: 6252001
description:
2025-02-06 04:48:59 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:58668: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
country_id: 2017370
description:
Feb  6 04:48:42 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
country_id: 1814991
description:
2025-02-06 04:48:57 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:33581: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
country_id: 2017370
description:
Feb  6 04:48:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
country_id: 2661886
description:
Feb  6 04:48:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.184.143.93
country_id: 1814991
description:
Feb  6 04:48:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.184.143.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
country_id: 149590
description:
Feb  6 04:48:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.95.16.210
country_id: 953987
description:
[2025-02-06 04:48:25 +0100] info [webmaild] 197.95.16.210 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
country_id: 2017370
description:
Feb  6 04:48:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
country_id: 1814991
description:
2025-02-06 04:48:50 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:55436: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
country_id: 149590
description:
2025-02-06 04:48:56 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:41760: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
country_id: 2017370
description:
2025-02-06 04:48:44 dovecot_plain authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:57066: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
country_id: 1210997
description:
2025-02-06 04:48:47 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:46176: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
country_id: 1210997
description:
Feb  6 04:48:50 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  6 04:48:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
country_id: 1269750
description:
Feb  6 04:48:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
country_id: 2510769
description:
2025-02-06 04:48:53 dovecot_plain authenticator failed for ([91.116.42.218]) [91.116.42.218]:57204: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
country_id: 6252001
description:
Feb  6 04:48:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
country_id: 1814991
description:
2025-02-06 04:48:59 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:35438: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/images/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.238.211.1
country_id: 3996063
description:
[2025-02-06 04:48:37 +0100] info [webmaild] 189.238.211.1 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
country_id: 1814991
description:
Feb  6 04:48:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  6 04:48:44 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
country_id: 2017370
description:
2025-02-06 04:48:46 dovecot_plain authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:55314: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 04:49:00 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:57103: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  6 04:48:33 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
country_id: 1814991
description:
Feb  6 04:48:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-06 04:48:48 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:40270: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
country_id: 1269750
description:
Feb  6 04:48:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-06 04:48:46 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:39782: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
country_id: 1814991
description:
2025-02-06 04:48:49 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:51337: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
country_id: 732800
description:
Feb  6 04:48:42 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
country_id: 1814991
description:
Feb  6 04:48:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
country_id: 1819730
description:
2025-02-06 04:48:47 dovecot_login authenticator failed for ([121.202.153.186]) [121.202.153.186]:16956: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
country_id: 1814991
description:
Feb  6 04:48:55 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-06 04:48:04 dovecot_plain authenticator failed for (severs) [77.51.214.170]:45317: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
country_id: 6252001
description:
Feb  6 04:49:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.184.143.93
country_id: 1814991
description:
2025-02-06 04:48:49 dovecot_plain authenticator failed for ([39.184.143.93]) [39.184.143.93]:52558: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
country_id: 2661886
description:
2025-02-06 04:48:54 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:58376: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.10.50
country_id: 1668284
description:
2025-02-06 04:48:55 dovecot_plain authenticator failed for 111-70-10-50.emome-ip.hinet.net [111.70.10.50]:38628: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  6 04:48:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  6 04:48:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
country_id: 1269750
description:
2025-02-06 04:48:54 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:49042: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.230
country_id: 1814991
description:
2025-02-06 04:48:39 dovecot_plain authenticator failed for ([27.40.100.230]) [27.40.100.230]:43650: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2025-02-06 04:48:45 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:55816: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
country_id: 3996063
description:
2025-02-06 04:48:46 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:54214: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-06 04:48:49 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:48248: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.57.125
country_id: 1668284
description:
Feb  6 04:48:51 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.57.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
country_id: 6252001
description:
2025-02-06 04:48:53 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:61890: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
country_id: 2017370
description:
Feb  6 04:48:42 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
country_id: 3017382
description:
Feb  6 04:48:42 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.24.117
country_id: 1814991
description:
Feb  6 04:48:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.24.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.85.114
country_id: 3469034
description:
2025-02-06 04:48:46 dovecot_plain authenticator failed for ([189.109.76.190]) [186.200.85.114]:57119: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
country_id: 6252001
description:
Feb  6 04:48:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
country_id: 1210997
description:
Feb  6 04:48:45 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
country_id: 2510769
description:
Feb  6 04:48:51 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2025-02-06 04:48:54 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:37626: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.12.33
country_id: 1269750
description:
Feb  6 04:49:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.12.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
country_id: 1269750
description:
2025-02-06 04:48:47 dovecot_plain authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:48751: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.237.108
country_id: 1835841
description:
Feb  6 04:48:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
country_id: 1835841
description:
Feb  6 04:48:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-06 04:48:56 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:34819: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
country_id: 298795
description:
Feb  6 04:48:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-02-06 04:48:46 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:22899: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
country_id: 1814991
description:
2025-02-06 04:48:48 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:60061: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
country_id: 2661886
description:
Feb  6 04:48:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
country_id: 1814991
description:
Feb  6 04:48:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-06 04:48:50 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:39621: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
country_id: 2017370
description:
2025-02-06 04:49:00 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:56164: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
country_id: 3895114
description:
Feb  6 04:48:45 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-06 04:48:44 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:60796: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2025-02-06 04:48:53 dovecot_plain authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:52608: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  6 04:48:56 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-02-06 04:48:45 dovecot_plain authenticator failed for ([103.203.210.119]) [103.203.210.119]:48130: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.24.117
country_id: 1814991
description:
2025-02-06 04:48:48 dovecot_plain authenticator failed for ([120.202.24.117]) [120.202.24.117]:54237: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.237.108
country_id: 1835841
description:
2025-02-06 04:48:50 dovecot_plain authenticator failed for ([218.147.237.108]) [218.147.237.108]:53766: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-06 04:48:51 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:43727: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
country_id: 3469034
description:
Feb  6 04:49:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
country_id: 1835841
description:
Feb  6 04:49:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-02-06 04:49:16 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:60748: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/images/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.14.155
country_id: 1814991
description:
2025-02-06 04:49:05 dovecot_login authenticator failed for ([183.237.14.155]) [183.237.14.155]:37660: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-06 04:49:07 dovecot_plain authenticator failed for ([177.6.235.62]) [177.6.235.62]:38449: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
country_id: 1835841
description:
Feb  6 04:49:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.121.214.105
country_id: 2017370
description:
Feb  6 04:49:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.121.214.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.205.251
country_id: 1814991
description:
Feb  6 04:49:07 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.205.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
country_id: 1814991
description:
2025-02-06 04:49:08 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:42856: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-02-06 04:49:26 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:49754: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 04:49:32 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:58406: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
country_id: 1835841
description:
2025-02-06 04:49:38 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:36412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
country_id: 3469034
description:
2025-02-06 04:49:54 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:49678: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
country_id: 2661886
description:
2025-02-06 04:49:06 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:58418: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
country_id: 6252001
description:
Feb  6 04:49:24 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  6 04:49:28 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 04:49:30 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.14.155
country_id: 1814991
description:
Feb  6 04:49:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.14.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
country_id: 1814991
description:
2025-02-06 04:49:03 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:42768: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
country_id: 390903
description:
Feb  6 04:49:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
country_id: 2077456
description:
Feb  6 04:49:16 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2025-02-06 04:49:16 dovecot_plain authenticator failed for ([121.159.71.249]) [121.159.71.249]:51476: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-02-06 04:49:17 dovecot_login authenticator failed for ([85.152.57.60]) [85.152.57.60]:54444: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
country_id: 1814991
description:
Feb  6 04:49:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
country_id: 1814991
description:
Feb  6 04:49:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
country_id: 1814991
description:
Feb  6 04:49:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
country_id: 1835841
description:
Feb  6 04:49:14 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.248.19
country_id: 1861060
description:
2025-02-06 04:49:15 dovecot_plain authenticator failed for p173020-obmd01.osaka.ocn.ne.jp [61.118.248.19]:46191: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  6 04:49:19 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.12.33
country_id: 1269750
description:
2025-02-06 04:49:02 dovecot_plain authenticator failed for ([122.175.12.33]) [122.175.12.33]:36043: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2025-02-06 04:49:06 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:51455: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
country_id: 6252001
description:
Feb  6 04:49:15 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  6 04:49:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.134
country_id: 1835841
description:
2025-02-06 04:49:27 dovecot_plain authenticator failed for ([211.109.93.134]) [211.109.93.134]:41142: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
country_id: 1819730
description:
2025-02-06 04:49:42 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:36280: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.205.251
country_id: 1814991
description:
2025-02-06 04:49:09 dovecot_plain authenticator failed for ([183.236.205.251]) [183.236.205.251]:39504: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-02-06 04:49:14 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:36475: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
country_id: 1835841
description:
Feb  6 04:49:36 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
country_id: 1814991
description:
2025-02-06 04:49:42 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:47065: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
country_id: 1835841
description:
Feb  6 04:49:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
country_id: 1814991
description:
2025-02-06 04:49:02 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:32474: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
country_id: 1835841
description:
Feb  6 04:49:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
country_id: 1819730
description:
2025-02-06 04:49:06 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:22415: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  6 04:49:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
country_id: 3865483
description:
Feb  6 04:49:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-06 04:49:04 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:60651: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
country_id: 1835841
description:
2025-02-06 04:49:08 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:48762: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
country_id: 1835841
description:
2025-02-06 04:49:11 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:37614: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
country_id: 2661886
description:
Feb  6 04:49:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-06 04:49:07 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:35527: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.115.198.118
country_id: 1168579
description:
[2025-02-06 04:49:09 +0100] info [webmaild] 103.115.198.118 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.57.60
country_id: 2510769
description:
Feb  6 04:49:15 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.57.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 04:49:38 ait sshd[978568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.149.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  6 04:49:41 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.178.220
country_id: 1814991
description:
Feb  6 04:49:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.178.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
country_id: 1835841
description:
2025-02-06 04:49:05 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:49987: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  6 04:49:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.81.78.32
country_id: 2510769
description:
Feb  6 04:49:07 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.81.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-06 04:49:08 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:40874: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.81.78.32
country_id: 2510769
description:
2025-02-06 04:49:09 dovecot_plain authenticator failed for ([185.81.78.32]) [185.81.78.32]:38459: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  6 04:49:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-06 04:49:14 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:52475: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
country_id: 2077456
description:
2025-02-06 04:49:18 dovecot_login authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:60299: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 04:49:21 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:41809: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
country_id: 1814991
description:
Feb  6 04:49:23 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
country_id: 1835841
description:
Feb  6 04:49:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 04:49:30 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:45429: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
country_id: 1819730
description:
Feb  6 04:49:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
country_id: 1819730
description:
Feb  6 04:49:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
country_id: 1814991
description:
2025-02-06 04:49:25 dovecot_login authenticator failed for ([183.249.1.72]) [183.249.1.72]:40879: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.142.105.18
country_id: 1814991
description:
Feb  6 04:49:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.142.105.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
country_id: 1562822
description:
Feb  6 04:49:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-02-06 04:49:02 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:43952: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  6 04:49:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.178.220
country_id: 1814991
description:
2025-02-06 04:49:07 dovecot_plain authenticator failed for ([120.197.178.220]) [120.197.178.220]:36254: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
country_id: 3865483
description:
2025-02-06 04:49:07 dovecot_login authenticator failed for (150-147-164-181.fibertel.com.ar) [181.164.147.150]:58935: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2025-02-06 04:49:11 dovecot_login authenticator failed for ([61.81.133.182]) [61.81.133.182]:37229: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-06 04:49:20 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:50583: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
country_id: 3469034
description:
Feb  6 04:49:52 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
country_id: 3469034
description:
Feb  6 04:49:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
country_id: 1562822
description:
2025-02-06 04:49:05 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:44116: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.121.214.105
country_id: 2017370
description:
2025-02-06 04:49:05 dovecot_plain authenticator failed for ([176.121.214.105]) [176.121.214.105]:55555: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
country_id: 390903
description:
2025-02-06 04:49:07 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:59084: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-06 04:49:14 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:35028: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
country_id: 6252001
description:
2025-02-06 04:49:17 dovecot_login authenticator failed for ([129.146.148.173]) [129.146.148.173]:58220: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-06 04:49:43 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:33430: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.16.118.120
country_id: 3469034
description:
[2025-02-06 04:50:35 +0100] info [webmaild] 177.16.118.120 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
country_id: 1562822
description:
Feb  6 04:50:32 ait sshd[979040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
country_id: 298795
description:
Feb  6 04:50:11 ait sshd[978789]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.123.236.52
country_id: 6252001
description:
2025-02-06 04:50:27 dovecot_login authenticator failed for syn-070-123-236-052.res.spectrum.com [70.123.236.52]:58138: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  6 04:50:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-06 04:50:06 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:57306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.157.246.26
country_id: 1814991
description:
Feb  6 04:50:10 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.157.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.157.246.26
country_id: 1814991
description:
2025-02-06 04:50:12 dovecot_login authenticator failed for ([117.157.246.26]) [117.157.246.26]:45780: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-50.80.76.51.123


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
country_id: 298795
description:
Feb  6 04:50:11 ait sshd[978789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
country_id: 1562822
description:
Feb  6 04:50:32 ait sshd[979040]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.72.113
country_id: 3469034
description:
[2025-02-06 04:51:02 +0100] info [webmaild] 191.7.72.113 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
country_id: 1835841
description:
Feb  6 04:51:10 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.204.112.147
country_id: 1814991
description:
Feb  6 04:51:24 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.204.112.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 134.0.154.50
country_id: 286963
description:
[2025-02-06 04:51:11 +0100] info [webmaild] 134.0.154.50 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-06 04:51:12 dovecot_login authenticator failed for ([211.193.37.116]) [211.193.37.116]:42274: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.204.112.147
country_id: 1814991
description:
2025-02-06 04:51:26 dovecot_login authenticator failed for ([163.204.112.147]) [163.204.112.147]:56028: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.232.6
country_id: 953987
description:
[2025-02-06 04:51:33 +0100] info [webmaild] 102.219.232.6 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  6 04:52:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
country_id: 6252001
description:
Feb  6 04:52:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.71.107
country_id: 1814991
description:
Feb  6 04:52:29 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.71.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
country_id: 1835841
description:
Feb  6 04:52:36 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.10.53.104
country_id: 3175395
description:
Feb  6 04:52:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.10.53.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-02-06 04:52:27 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:34310: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 04:52:39 ait sshd[979920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-06 04:52:59 dovecot_login authenticator failed for ([114.242.61.19]) [114.242.61.35]:57598: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-02-06 04:53:00 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:32828: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.137
country_id: 1814991
description:
Feb  6 04:52:23 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-02-06 04:52:48 dovecot_plain authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:55466: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-06 04:52:39 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:33947: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
country_id: 1269750
description:
Feb  6 04:52:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
country_id: 6252001
description:
2025-02-06 04:52:59 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:55263: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
country_id: 1835841
description:
Feb  6 04:53:01 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
country_id: 1814991
description:
Feb  6 04:52:24 ait sshd[979754]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.71.107
country_id: 1814991
description:
2025-02-06 04:52:31 dovecot_login authenticator failed for ([36.32.223.199]) [58.242.71.107]:46840: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 04:52:39 ait sshd[979920]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
country_id: 1814991
description:
Feb  6 04:52:24 ait sshd[979754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
country_id: 6252001
description:
Feb  6 04:52:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.10.53.104
country_id: 3175395
description:
2025-02-06 04:52:49 dovecot_login authenticator failed for host-79-10-53-104.business.telecomitalia.it [79.10.53.104]:50134: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-02-06 04:53:02 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:54454: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
country_id: 1835841
description:
2025-02-06 04:52:38 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:59394: 535 Incorrect authentication data (set_id=assdas1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/engine1/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
country_id: 6252001
description:
Feb  6 04:52:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.137
country_id: 1814991
description:
2025-02-06 04:52:25 dovecot_plain authenticator failed for ([119.62.184.137]) [119.62.184.137]:54807: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  6 04:52:37 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
country_id: 6252001
description:
2025-02-06 04:52:49 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:50230: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
country_id: 1512440
description:
Feb  6 04:52:26 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
country_id: 1512440
description:
2025-02-06 04:52:28 dovecot_login authenticator failed for ([195.158.19.6]) [195.158.19.6]:56846: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.178.158
country_id: 3469034
description:
Feb  6 04:52:39 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.178.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.178.158
country_id: 3469034
description:
2025-02-06 04:52:41 dovecot_login authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:44010: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 04:53:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.69.19.219
country_id: 2542007
description:
[2025-02-06 04:53:32 +0100] info [webmaild] 105.69.19.219 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.22.42
country_id: 3469034
description:
[2025-02-06 04:53:34 +0100] info [webmaild] 186.249.22.42 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
country_id: 6252001
description:
Feb  6 04:53:38 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-06 04:53:45 dovecot_login authenticator failed for ([189.39.187.16]) [189.39.187.16]:53983: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  6 04:53:07 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
country_id: 3895114
description:
2025-02-06 04:53:07 dovecot_login authenticator failed for ([186.179.80.12]) [186.179.80.12]:54024: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-06 04:53:09 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:6718: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.136.193.248
country_id: 2510769
description:
Feb  6 04:53:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.136.193.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  6 04:53:29 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-06 04:53:33 dovecot_login authenticator failed for ([180.166.162.78]) [180.166.162.78]:58863: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.125
country_id: 1036973
description:
Feb  6 04:53:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
country_id: 1835841
description:
Feb  6 04:53:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
country_id: 6252001
description:
2025-02-06 04:53:22 dovecot_login authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:50710: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 04:53:28 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:5562: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.193.248
country_id: 2510769
description:
2025-02-06 04:53:49 dovecot_login authenticator failed for (248-193-136-45.ddns.movitel.tv) [45.136.193.248]:45942: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/engine1/js/js/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
country_id: 1819730
description:
Feb  6 04:53:19 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.134.13.108
country_id: 1814991
description:
Feb  6 04:53:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.134.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  6 04:53:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.134.13.108
country_id: 1814991
description:
2025-02-06 04:53:48 dovecot_login authenticator failed for ([117.134.13.108]) [117.134.13.108]:18200: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
country_id: 1814991
description:
2025-02-06 04:53:41 dovecot_login authenticator failed for ([61.233.4.50]) [61.233.4.50]:47038: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-06 04:53:03 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:59272: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
country_id: 1835841
description:
2025-02-06 04:53:17 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:54398: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
country_id: 6252001
description:
Feb  6 04:53:20 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
country_id: 1835841
description:
Feb  6 04:53:15 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
country_id: 1814991
description:
Feb  6 04:53:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 04:53:59 ait sshd[980283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.147.136.221
country_id: 3175395
description:
Feb  6 04:53:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.147.136.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.95.97.158
country_id: 1814991
description:
2025-02-06 04:53:47 dovecot_login authenticator failed for ([180.166.163.26]) [101.95.97.158]:57858: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-06 04:53:31 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:20409: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
country_id: 1814991
description:
Feb  6 04:53:39 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-02-06 04:53:27 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:49242: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 04:53:33 dovecot_login authenticator failed for ([1.242.165.148]) [1.242.165.148]:52103: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
country_id: 1835841
description:
2025-02-06 04:53:42 dovecot_login authenticator failed for ([175.214.52.214]) [175.214.52.214]:3535: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 04:53:26 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
country_id: 1668284
description:
2025-02-06 04:53:55 dovecot_login authenticator failed for 111-70-23-248.emome-ip.hinet.net [111.70.23.248]:37349: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 04:53:59 ait sshd[980283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
country_id: 1819730
description:
2025-02-06 04:54:02 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:45471: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.147.136.221
country_id: 3175395
description:
2025-02-06 04:53:11 dovecot_plain authenticator failed for net-93-147-136-221.cust.vodafonedsl.it [93.147.136.221]:58479: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Feb  6 04:53:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-02-06 04:53:14 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:65340: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
country_id: 1819730
description:
2025-02-06 04:53:21 dovecot_login authenticator failed for (m121-202-200-120.smartone.com) [121.202.200.120]:24041: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
country_id: 1835841
description:
Feb  6 04:53:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
country_id: 1819730
description:
Feb  6 04:54:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
country_id: 3895114
description:
Feb  6 04:53:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
country_id: 6252001
description:
2025-02-06 04:53:40 dovecot_login authenticator failed for ([130.250.134.35]) [130.250.134.35]:42524: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.248
country_id: 1668284
description:
Feb  6 04:53:53 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
country_id: 1835841
description:
2025-02-06 04:54:01 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:55922: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
country_id: 1562822
description:
Feb  6 04:54:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
country_id: 1562822
description:
2025-02-06 04:54:33 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:21905: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-06 04:54:33 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:58408: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 04:54:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
country_id: 3469034
description:
Feb  6 04:54:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 04:54:50 dovecot_login authenticator failed for ([20.239.187.13]) [20.239.187.13]:49032: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
country_id: 1835841
description:
Feb  6 04:54:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
country_id: 3469034
description:
2025-02-06 04:55:00 dovecot_login authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:42306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
country_id: 3469034
description:
Feb  6 04:54:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.246.178.218
country_id: 1814991
description:
Feb  6 04:54:14 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.246.178.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 04:54:04 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-196.tpgi.com.au) [110.175.220.250]:57173: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 04:54:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.173.255
country_id: 3508796
description:
[2025-02-06 04:54:02 +0100] info [webmaild] 45.164.173.255 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.159.114
country_id: 1861060
description:
2025-02-06 04:54:05 dovecot_login authenticator failed for p88115-obmd01.osaka.ocn.ne.jp [180.7.159.114]:45091: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.218.101
country_id: 1269750
description:
Feb  6 04:54:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.79.218.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
country_id: 1269750
description:
2025-02-06 04:54:45 dovecot_login authenticator failed for ([112.196.60.13]) [112.196.60.13]:59656: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
country_id: 3469034
description:
2025-02-06 04:54:51 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:53012: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/engine1/engine1/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.159.114
country_id: 1861060
description:
Feb  6 04:54:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.159.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.70.240.95
country_id: 3469034
description:
[2025-02-06 04:54:05 +0100] info [webmaild] 177.70.240.95 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.178.218
country_id: 1814991
description:
2025-02-06 04:54:16 dovecot_login authenticator failed for ([183.246.178.218]) [183.246.178.218]:40052: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-02-06 04:54:32 dovecot_plain authenticator failed for ([50.79.249.83]) [50.79.249.83]:7654: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-02-06 04:54:42 dovecot_plain authenticator failed for ([182.79.218.101]) [182.79.218.101]:57999: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
country_id: 1269750
description:
Feb  6 04:54:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 04:56:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.116.2.182
country_id: 1814991
description:
2025-02-06 04:55:06 dovecot_login authenticator failed for ([124.116.2.182]) [124.116.2.182]:38768: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
country_id: 290557
description:
2025-02-06 04:55:27 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:45266: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-06 04:55:44 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:27192: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.166.200
country_id: 1814991
description:
2025-02-06 04:55:23 dovecot_login authenticator failed for ([183.233.166.200]) [183.233.166.200]:57159: 535 Incorrect authentication data (set_id=eng20a00113y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
country_id: 1814991
description:
Feb  6 04:55:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-06 04:55:04 dovecot_login authenticator failed for ([37.224.119.19]) [37.224.119.19]:54068: 535 Incorrect authentication data (set_id=cole@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Feb  6 04:55:14 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
country_id: 1814991
description:
Feb  6 04:55:42 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
country_id: 2661886
description:
2025-02-06 04:56:02 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (theen) [217.215.254.115]:55964: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.116.2.182
country_id: 1814991
description:
Feb  6 04:55:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.116.2.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
country_id: 2245662
description:
Feb  6 04:55:16 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-02-06 04:55:17 dovecot_login authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:58735: 535 Incorrect authentication data (set_id=cole)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.46.30.239
country_id: 1835841
description:
Feb  6 04:55:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.46.30.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
country_id: 2661886
description:
Feb  6 04:56:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.109.217.15
country_id: 783754
description:
2025-02-06 04:56:01 dovecot_plain authenticator failed for (cariss) [192.109.217.15]:32921: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
country_id: 1814991
description:
2025-02-06 04:55:04 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:53490: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/engine1/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
country_id: 3865483
description:
2025-02-06 04:55:19 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:58664: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
country_id: 6251999
description:
Feb  6 04:55:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.17.2
country_id: 1880251
description:
47.128.17.2 - - [06/Feb/2025:04:55:27 +0100] "GET /wp-content/plugins/header-footer-elementor/inc/widgets-css/frontend.css?ver=1.6.9 HTTP/2.0" 200 1447 admissions.ait-edu.us "https://admissions.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15647720" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.17.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.32.104
country_id: 1269750
description:
Feb  6 04:55:15 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.32.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2025-02-06 04:55:16 dovecot_login authenticator failed for ([196.189.126.10]) [196.189.126.10]:42320: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
country_id: 3865483
description:
Feb  6 04:55:17 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2025-02-06 04:55:18 dovecot_login authenticator failed for ([41.214.10.178]) [41.214.10.178]:57700: 535 Incorrect authentication data (set_id=eng20a00070y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.237.10
country_id: 290557
description:
Feb  6 04:55:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.237.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.233.196
country_id: 1861060
description:
2025-02-06 04:55:48 dovecot_login authenticator failed for p46196-obmd01.osaka.ocn.ne.jp [153.141.233.196]:49761: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
country_id: 3469034
description:
Feb  6 04:55:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
country_id: 6251999
description:
2025-02-06 04:55:04 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:59710: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-02-06 04:55:05 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:38935: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Feb  6 04:55:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-02-06 04:55:50 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:45936: 535 Incorrect authentication data (set_id=eng20a00113y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.30.239
country_id: 1835841
description:
2025-02-06 04:55:56 dovecot_login authenticator failed for ([14.46.30.239]) [14.46.30.239]:54984: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.166.200
country_id: 1814991
description:
Feb  6 04:55:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.166.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.233.196
country_id: 1861060
description:
Feb  6 04:55:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.233.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
country_id: 1814991
description:
Feb  6 04:56:23 ait sshd[981429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.108.177.110
country_id: 1835841
description:
Feb  6 04:56:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.108.177.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.142.184.248
country_id: 1210997
description:
[2025-02-06 04:56:44 +0100] info [webmaild] 103.142.184.248 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
country_id: 1814991
description:
2025-02-06 04:56:10 dovecot_login authenticator failed for ([58.18.42.74]) [58.18.42.74]:45126: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
country_id: 1814991
description:
Feb  6 04:56:23 ait sshd[981429]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/js/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
country_id: 1814991
description:
Feb  6 04:56:08 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.118.237.143
country_id: 3865483
description:
[2025-02-06 04:56:06 +0100] info [webmaild] 181.118.237.143 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.171.194
country_id: 3469034
description:
[2025-02-06 04:56:09 +0100] info [webmaild] 177.22.171.194 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  6 04:56:24 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-06 04:56:26 dovecot_login authenticator failed for ([175.136.192.106]) [175.136.192.106]:48518: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.244.74.222
country_id: 2017370
description:
[2025-02-06 04:56:35 +0100] info [webmaild] 91.244.74.222 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-02-06 04:57:01 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:54393: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
country_id: 6252001
description:
Feb  6 04:57:10 ait sshd[981711]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 04:57:11 ait sshd[981713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.200.20.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.165.222
country_id: 1814991
description:
Feb  6 04:57:07 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
country_id: 6252001
description:
Feb  6 04:57:10 ait sshd[981711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 04:57:11 ait sshd[981713]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.200.20.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/js/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.165.222
country_id: 1814991
description:
2025-02-06 04:57:09 dovecot_login authenticator failed for ([183.247.165.222]) [183.247.165.222]:58757: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-02-06 04:58:43 dovecot_login authenticator failed for ([122.224.164.194]) [122.224.164.194]:49757: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.205.156.56
country_id: 690791
description:
[2025-02-06 04:58:54 +0100] info [webmaild] 62.205.156.56 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
country_id: 1814991
description:
Feb  6 04:58:41 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 04:58:40 ait sshd[982281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.0.30


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.230
country_id: 1269750
description:
2025-02-06 04:58:52 dovecot_login authenticator failed for (nsg-corporate-230.228.187.122.airtel.in) [122.187.228.230]:52746: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.230
country_id: 1269750
description:
Feb  6 04:58:50 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 04:58:14 ait sshd[982065]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.22.115.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 04:58:14 ait sshd[982065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/data1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
country_id: 2017370
description:
2025-02-06 04:59:23 dovecot_plain authenticator failed for (hosubbele) [31.173.9.222]:37998: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.21.15
country_id: 3469034
description:
[2025-02-06 04:59:27 +0100] info [webmaild] 138.122.21.15 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2025-02-06 04:59:29 dovecot_login authenticator failed for ([183.247.171.186]) [183.247.171.186]:52516: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.52.106
country_id: 1814991
description:
2025-02-06 04:59:34 dovecot_login authenticator failed for ([218.22.52.106]) [218.22.52.106]:45619: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.134
country_id: 1814991
description:
2025-02-06 04:59:38 dovecot_login authenticator failed for ([27.45.233.134]) [27.45.233.134]:56698: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
country_id: 2017370
description:
Feb  6 04:59:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-02-06 04:59:23 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:51192: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.171.186
country_id: 1814991
description:
Feb  6 04:59:27 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.171.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
country_id: 2963597
description:
Feb  6 04:59:31 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
country_id: 99237
description:
Feb  6 04:59:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
country_id: 2017370
description:
2025-02-06 04:59:26 dovecot_login authenticator failed for (95-165-72-156.dynamic.spd-mgts.ru) [95.165.72.156]:57330: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.208.228
country_id: 1668284
description:
2025-02-06 04:59:33 H=(mail.goudirect.com) [165.154.208.228]:65314 F=<heygyszhxad@goudirect.com> rejected RCPT <validxxxg@gmail.com>: Rejected relay attempt: '165.154.208.228' From: 'heygyszhxad@goudirect.com' To: 'validxxxg@gmail.com'


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
country_id: 2661886
description:
2025-02-06 04:59:58 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:60690: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.224.178
country_id: 3469034
description:
[2025-02-06 04:59:02 +0100] info [webmaild] 45.183.224.178 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.101.99
country_id: 3469034
description:
[2025-02-06 04:59:32 +0100] info [webmaild] 186.235.101.99 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.134
country_id: 1814991
description:
Feb  6 04:59:36 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
country_id: 2017370
description:
Feb  6 04:59:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
country_id: 2017370
description:
2025-02-06 04:59:56 dovecot_login authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:54326: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.232.115
country_id: 6252001
description:
Feb  6 04:59:19 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.229.232.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.52.106
country_id: 1814991
description:
Feb  6 04:59:32 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.52.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.165.230
country_id: 1814991
description:
2025-02-06 05:00:31 dovecot_login authenticator failed for ([183.237.165.230]) [183.237.165.230]:57627: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
country_id: 1814991
description:
Feb  6 05:00:35 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.46.20
country_id: 1861060
description:
Feb  6 05:00:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.46.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
country_id: 2215636
description:
Feb  6 05:00:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
country_id: 6251999
description:
Feb  6 05:00:06 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.40.159
country_id: 1861060
description:
2025-02-06 05:00:06 dovecot_login authenticator failed for p279160-obmd01.tokyo.ocn.ne.jp [153.141.40.159]:39402: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.165.230
country_id: 1814991
description:
Feb  6 05:00:29 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.165.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.38.5
country_id: 1835841
description:
Feb  6 05:00:43 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.38.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-06 05:00:59 dovecot_login authenticator failed for ([210.113.122.243]) [210.113.122.243]:38122: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-06 05:00:56 dovecot_plain authenticator failed for (undoheded) [37.224.119.19]:35320: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.46.20
country_id: 1861060
description:
2025-02-06 05:00:04 dovecot_login authenticator failed for p285021-obmd01.tokyo.ocn.ne.jp [153.141.46.20]:34799: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
country_id: 6251999
description:
2025-02-06 05:00:08 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:60030: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
country_id: 1814991
description:
2025-02-06 05:00:37 dovecot_login authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:47604: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.38.5
country_id: 1835841
description:
2025-02-06 05:00:45 dovecot_login authenticator failed for ([211.169.38.5]) [211.169.38.5]:53872: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
country_id: 1835841
description:
2025-02-06 05:00:51 dovecot_login authenticator failed for ([218.55.177.39]) [218.55.177.39]:33384: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
country_id: 102358
description:
Feb  6 05:00:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.40.159
country_id: 1861060
description:
Feb  6 05:00:04 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.40.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
country_id: 2215636
description:
2025-02-06 05:00:06 dovecot_login authenticator failed for ([165.16.44.5]) [165.16.44.5]:47158: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
country_id: 1835841
description:
Feb  6 05:00:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
country_id: 1835841
description:
Feb  6 05:00:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
country_id: 1819730
description:
Feb  6 05:01:08 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.63
country_id: 2635167
description:
Feb  6 05:01:53 ait sshd[983626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
country_id: 1269750
description:
2025-02-06 05:01:20 dovecot_login authenticator failed for (static.ill.59.97.139.38.bsnl.co.in) [59.97.139.38]:36996: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
country_id: 1819730
description:
2025-02-06 05:01:10 dovecot_login authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:24101: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.63
country_id: 2635167
description:
Feb  6 05:01:53 ait sshd[983626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.63  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 05:01:54 ait sshd[983630]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 05:01:02 ait sshd[983364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.223.83.192
country_id: 298795
description:
[2025-02-06 05:01:30 +0100] info [webmaild] 31.223.83.192 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.13.133.140
country_id: 3469034
description:
[2025-02-06 05:01:38 +0100] info [webmaild] 189.13.133.140 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 05:01:54 ait sshd[983630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/js/engine1/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
country_id: 1269750
description:
Feb  6 05:01:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
country_id: 1880251
description:
Feb  6 05:02:07 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
country_id: 6252001
description:
Feb  6 05:02:27 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
country_id: 1835841
description:
Feb  6 05:02:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
country_id: 1835841
description:
2025-02-06 05:02:50 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:59512: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
country_id: 1668284
description:
2025-02-06 05:02:55 dovecot_login authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:40682: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.180.58
country_id: 1835841
description:
Feb  6 05:02:10 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.180.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-06 05:02:20 dovecot_login authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:51100: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.229.19.193
country_id: 3865483
description:
2025-02-06 05:02:29 dovecot_login authenticator failed for ([45.229.19.193]) [45.229.19.193]:60670: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
country_id: 1835841
description:
2025-02-06 05:02:36 dovecot_login authenticator failed for ([220.119.126.81]) [220.119.126.81]:37318: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
country_id: 1668284
description:
2025-02-06 05:02:49 dovecot_login authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:35745: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
country_id: 1814991
description:
2025-02-06 05:02:22 dovecot_login authenticator failed for ([222.180.4.150]) [222.180.4.150]:36326: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  6 05:02:29 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
country_id: 1814991
description:
Feb  6 05:02:32 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
country_id: 2017370
description:
Feb  6 05:02:11 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-06 05:02:13 dovecot_login authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:57644: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
country_id: 2017370
description:
Feb  6 05:02:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
country_id: 1814991
description:
2025-02-06 05:02:22 dovecot_login authenticator failed for mail.toptronicsinc.com [218.4.156.254]:45255: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.241
country_id: 6252001
description:
2025-02-06 05:02:47 dovecot_login authenticator failed for (mobile-166-195-196-241.mycingular.net) [166.195.196.241]:42398: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
country_id: 1814991
description:
Feb  6 05:02:19 ait sshd[983731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
country_id: 2017370
description:
2025-02-06 05:02:21 dovecot_login authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:53304: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
country_id: 1835841
description:
Feb  6 05:02:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/js/images/data1/images/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
country_id: 1880251
description:
2025-02-06 05:02:09 dovecot_login authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:59226: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
country_id: 6252001
description:
Feb  6 05:02:38 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-06 05:02:41 dovecot_login authenticator failed for ([171.227.200.201]) [171.227.200.201]:42097: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  6 05:02:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 05:02:09 dovecot_login authenticator failed for ([60.174.40.155]) [60.174.40.155]:46416: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
country_id: 1814991
description:
Feb  6 05:02:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.94.206.187
country_id: 3469034
description:
Feb  6 05:02:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.94.206.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Feb  6 05:02:19 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.129
country_id: 294640
description:
2025-02-06 05:02:31 dovecot_login authenticator failed for (2-55-88-129.orange.net.il) [2.55.88.129]:42732: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
country_id: 1814991
description:
2025-02-06 05:02:34 dovecot_login authenticator failed for ([111.172.120.32]) [111.172.120.32]:46898: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.144.132
country_id: 1835841
description:
Feb  6 05:02:49 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.144.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
country_id: 1814991
description:
Feb  6 05:02:55 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
country_id: 6252001
description:
Feb  6 05:02:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
country_id: 1814991
description:
2025-02-06 05:02:25 dovecot_login authenticator failed for (235.236.163.222.adsl-pool.jlccptt.net.cn) [222.163.236.235]:48100: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.119.126.81
country_id: 1835841
description:
Feb  6 05:02:34 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.119.126.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.219.254
country_id: 1814991
description:
2025-02-06 05:02:34 dovecot_login authenticator failed for ([124.115.219.254]) [124.115.219.254]:43310: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
country_id: 1562822
description:
Feb  6 05:02:39 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.230.86
country_id: 1814991
description:
Feb  6 05:02:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.230.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2025-02-06 05:02:49 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:33882: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-02-06 05:02:11 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:56576: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
country_id: 6252001
description:
Feb  6 05:02:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 136.169.243.108
country_id: 2017370
description:
[2025-02-06 05:02:05 +0100] info [webmaild] 136.169.243.108 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-02-06 05:02:21 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:38170: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.245.186
country_id: 3469034
description:
Feb  6 05:02:22 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.245.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
country_id: 1814991
description:
Feb  6 05:02:23 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
country_id: 6252001
description:
2025-02-06 05:02:29 dovecot_login authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:63280: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
country_id: 1814991
description:
2025-02-06 05:02:48 dovecot_login authenticator failed for ([218.92.230.86]) [218.92.230.86]:57710: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
country_id: 1814991
description:
2025-02-06 05:02:57 dovecot_login authenticator failed for ([122.227.206.42]) [122.227.206.42]:35236: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
country_id: 1814991
description:
Feb  6 05:02:19 ait sshd[983731]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.172.157.163
country_id: 1814991
description:
2025-02-06 05:02:48 dovecot_login authenticator failed for ([219.140.170.34]) [59.172.157.163]:53877: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.6.251.202
country_id: 1562822
description:
Feb  6 05:02:55 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.6.251.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
country_id: 2750405
description:
Feb  6 05:02:56 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.219.254
country_id: 1814991
description:
Feb  6 05:02:32 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.219.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.144.132
country_id: 1835841
description:
2025-02-06 05:02:51 dovecot_login authenticator failed for ([119.195.144.132]) [119.195.144.132]:37839: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.201.70
country_id: 3469034
description:
[2025-02-06 05:02:05 +0100] info [webmaild] 45.163.201.70 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
country_id: 2017370
description:
Feb  6 05:02:19 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
country_id: 3469034
description:
2025-02-06 05:02:20 dovecot_login authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:32926: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.129
country_id: 294640
description:
Feb  6 05:02:29 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-06 05:02:31 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:43920: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
country_id: 1814991
description:
Feb  6 05:02:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
country_id: 1814991
description:
Feb  6 05:02:20 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.245.186
country_id: 3469034
description:
2025-02-06 05:02:24 dovecot_login authenticator failed for 131.0.245.186.core3.com.br [131.0.245.186]:49802: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
country_id: 1814991
description:
Feb  6 05:02:38 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.172.157.163
country_id: 1814991
description:
Feb  6 05:02:46 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.172.157.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.166
country_id: 1668284
description:
Feb  6 05:02:47 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
country_id: 1814991
description:
Feb  6 05:02:20 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
country_id: 1814991
description:
2025-02-06 05:02:20 dovecot_login authenticator failed for ([124.89.60.158]) [124.89.60.158]:36588: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
country_id: 6252001
description:
2025-02-06 05:02:49 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:33980: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.6.251.202
country_id: 1562822
description:
2025-02-06 05:02:57 dovecot_login authenticator failed for ([117.6.251.202]) [117.6.251.202]:41652: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 05:02:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2025-02-06 05:02:12 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:43914: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
country_id: 6252001
description:
2025-02-06 05:02:40 dovecot_login authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:52039: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
country_id: 1814991
description:
2025-02-06 05:02:40 dovecot_login authenticator failed for ([221.130.87.125]) [221.130.87.125]:55741: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-02-06 05:02:58 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:35490: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
country_id: 99237
description:
2025-02-06 05:03:01 dovecot_login authenticator failed for ([65.20.165.83]) [65.20.165.83]:42286: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  6 05:03:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-06 05:03:23 dovecot_login authenticator failed for ([218.98.160.119]) [218.98.160.117]:58412: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-02-06 05:03:42 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:43838: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
country_id: 2017370
description:
Feb  6 05:03:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 05:03:30 ait sshd[984178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.19.211.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-06 05:03:01 dovecot_login authenticator failed for ([61.83.232.94]) [221.163.182.162]:46514: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/engine1/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.95.179
country_id: 1814991
description:
Feb  6 05:03:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.95.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
country_id: 2077456
description:
Feb  6 05:03:08 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.46
country_id: 1814991
description:
2025-02-06 05:03:24 dovecot_plain authenticator failed for ([112.91.253.46]) [112.91.253.46]:37515: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
country_id: 1835841
description:
2025-02-06 05:03:25 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:34168: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 05:03:34 ait sshd[984203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
country_id: 6252001
description:
Feb  6 05:03:57 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
country_id: 1819730
description:
Feb  6 05:03:58 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
country_id: 1814991
description:
Feb  6 05:03:59 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2025-02-06 05:03:59 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:52320: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
country_id: 1835841
description:
Feb  6 05:03:23 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
country_id: 1819730
description:
Feb  6 05:03:29 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
country_id: 3175395
description:
2025-02-06 05:03:30 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:37377: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
country_id: 2661886
description:
Feb  6 05:03:54 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
country_id: 1814991
description:
Feb  6 05:04:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
country_id: 1835841
description:
Feb  6 05:04:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 05:03:30 ait sshd[984178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.19.211.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Feb  6 05:03:34 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
country_id: 1814991
description:
Feb  6 05:03:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
country_id: 6252001
description:
2025-02-06 05:03:59 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:37048: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
country_id: 1819730
description:
2025-02-06 05:04:00 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:57737: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
country_id: 3017382
description:
2025-02-06 05:03:20 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:59953: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.46
country_id: 1814991
description:
Feb  6 05:03:22 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-02-06 05:03:36 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:53418: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
country_id: 1814991
description:
2025-02-06 05:03:01 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:50112: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
country_id: 2077456
description:
2025-02-06 05:03:10 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:41003: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.148.110
country_id: 290557
description:
Feb  6 05:03:35 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.148.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.148.110
country_id: 290557
description:
2025-02-06 05:03:37 dovecot_plain authenticator failed for ([94.202.148.110]) [94.202.148.110]:33149: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 05:03:48 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
country_id: 2661886
description:
2025-02-06 05:03:56 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:39530: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
country_id: 3017382
description:
Feb  6 05:03:18 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 05:03:34 ait sshd[984203]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.39.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 05:03:56 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.95.179
country_id: 1814991
description:
2025-02-06 05:03:07 dovecot_login authenticator failed for ([183.236.95.179]) [183.236.95.179]:50328: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
country_id: 1819730
description:
2025-02-06 05:03:31 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:40746: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-02-06 05:04:00 dovecot_plain authenticator failed for ([195.133.156.133]) [195.133.156.133]:53188: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.33
country_id: 1819730
description:
Feb  6 05:04:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
country_id: 3469034
description:
Feb  6 05:04:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.50.79.182
country_id: 3469034
description:
[2025-02-06 05:04:45 +0100] info [webmaild] 201.50.79.182 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
country_id: 1814991
description:
2025-02-06 05:04:02 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:54852: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-02-06 05:04:07 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:46604: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-06 05:04:15 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:64079: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
country_id: 6252001
description:
2025-02-06 05:04:43 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:57743: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
country_id: 2963597
description:
Feb  6 05:04:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
country_id: 1814991
description:
2025-02-06 05:04:15 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:35532: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
country_id: 2017370
description:
2025-02-06 05:04:18 dovecot_plain authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru [87.240.58.132]:33258: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-02-06 05:04:22 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:50454: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.37
country_id: 1819730
description:
Feb  6 05:04:30 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.37
country_id: 1819730
description:
2025-02-06 05:04:32 dovecot_plain authenticator failed for (m121-202-206-37.smartone.com) [121.202.206.37]:12627: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  6 05:04:40 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
country_id: 1814991
description:
Feb  6 05:04:01 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
country_id: 6252001
description:
Feb  6 05:04:24 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
country_id: 1814991
description:
2025-02-06 05:04:05 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:55304: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.29.20.52
country_id: 2635167
description:
2025-02-06 05:04:24 dovecot_plain authenticator failed for host-92-29-20-52.as13285.net [92.29.20.52]:33779: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.65.134
country_id: 1814991
description:
2025-02-06 05:04:32 dovecot_plain authenticator failed for ([183.238.65.134]) [183.238.65.134]:56319: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
country_id: 1814991
description:
2025-02-06 05:04:04 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:42693: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.51.129.5
country_id: 6252001
description:
Feb  6 05:04:23 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.51.129.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
country_id: 6252001
description:
2025-02-06 05:04:24 dovecot_plain authenticator failed for ([23.237.83.130]) [23.237.83.130]:44386: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-06 05:04:42 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:41708: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
country_id: 3865483
description:
2025-02-06 05:04:16 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:45299: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
country_id: 6252001
description:
2025-02-06 05:04:26 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:39420: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
country_id: 2963597
description:
2025-02-06 05:04:02 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:20167: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
country_id: 1269750
description:
Feb  6 05:04:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.17.230.112
country_id: 3469034
description:
[2025-02-06 05:04:16 +0100] info [webmaild] 187.17.230.112 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.147.136.221
country_id: 3175395
description:
2025-02-06 05:04:19 dovecot_plain authenticator failed for net-93-147-136-221.cust.vodafonedsl.it [93.147.136.221]:47336: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.51.129.5
country_id: 6252001
description:
2025-02-06 05:04:25 dovecot_plain authenticator failed for 206-51-129-5.nktelco.net [206.51.129.5]:59392: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
country_id: 1269750
description:
2025-02-06 05:04:03 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:57420: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
country_id: 1814991
description:
Feb  6 05:04:02 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
country_id: 1835841
description:
2025-02-06 05:04:02 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:42528: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
country_id: 1814991
description:
Feb  6 05:04:13 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
country_id: 2017370
description:
Feb  6 05:04:16 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
country_id: 1269750
description:
Feb  6 05:04:01 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
country_id: 1814991
description:
2025-02-06 05:04:01 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:50585: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2025-02-06 05:04:02 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:38661: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
country_id: 1814991
description:
2025-02-06 05:04:03 dovecot_plain authenticator failed for ([39.165.154.222]) [39.165.154.222]:48762: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
country_id: 2661886
description:
Feb  6 05:04:09 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
country_id: 1814991
description:
2025-02-06 05:04:12 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:53276: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/engine1/js/js/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
country_id: 1880251
description:
2025-02-06 05:04:23 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:35876: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  6 05:04:13 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  6 05:04:12 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  6 05:04:22 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  6 05:04:25 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 05:04:27 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:51718: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
country_id: 6252001
description:
Feb  6 05:04:41 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
country_id: 1814991
description:
Feb  6 05:04:03 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.152.58.21
country_id: 3996063
description:
[2025-02-06 05:04:26 +0100] info [webmaild] 189.152.58.21 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
country_id: 2661886
description:
2025-02-06 05:04:11 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:58882: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
country_id: 3865483
description:
Feb  6 05:04:14 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 05:04:23 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:41901: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2025-02-06 05:04:07 dovecot_plain authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:57862: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-06 05:04:14 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:58875: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
country_id: 3469034
description:
2025-02-06 05:04:14 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:38054: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.147.136.221
country_id: 3175395
description:
Feb  6 05:04:17 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.147.136.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
country_id: 1880251
description:
Feb  6 05:04:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.29.20.52
country_id: 2635167
description:
Feb  6 05:04:22 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.29.20.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.65.134
country_id: 1814991
description:
Feb  6 05:04:30 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.65.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.120.40
country_id: 1814991
description:
Feb  6 05:04:10 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.120.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
country_id: 1814991
description:
Feb  6 05:04:05 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
country_id: 1269750
description:
Feb  6 05:04:20 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  6 05:04:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
country_id: 6252001
description:
Feb  6 05:04:22 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.1.60
country_id: 1835841
description:
Feb  6 05:04:36 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.1.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-02-06 05:04:38 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:56389: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
country_id: 1835841
description:
Feb  6 05:04:00 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.166.197
country_id: 3469034
description:
[2025-02-06 05:05:00 +0100] info [webmaild] 170.0.166.197 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 05:04:24 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:56936: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-06 05:04:14 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:29064: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
country_id: 3175395
description:
Feb  6 05:05:21 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-05.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
country_id: 3175395
description:
2025-02-06 05:05:23 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (skiltion) [2.36.64.247]:53950: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/images/images/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 05:05:28 ait sshd[985016]: pam_imunify(sshd:auth): [IM360_RBL] The IP 4.240.73.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 05:05:28 ait sshd[985016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.240.73.64  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 05:06:31 ait sshd[985497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.5.41.230
country_id: 3895114
description:
[2025-02-06 05:06:43 +0100] info [webmaild] 190.5.41.230 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/js/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 05:06:37 ait sshd[985536]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 05:06:31 ait sshd[985497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 05:06:37 ait sshd[985536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
country_id: 732800
description:
Feb  6 05:06:51 ait auth[970030]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
country_id: 732800
description:
2025-02-06 05:06:53 dovecot_plain authenticator failed for (demed) [109.160.123.6]:60302: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:05-07.20.171.207.20||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.20
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.153.190.88
country_id: 289688
description:
[2025-02-06 05:07:13 +0100] info [webmaild] 178.153.190.88 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.64.249.37
country_id: 690791
description:
[2025-02-06 05:07:36 +0100] info [webmaild] 195.64.249.37 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.107.3.172
country_id: 3469034
description:
[2025-02-06 05:07:05 +0100] info [webmaild] 179.107.3.172 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 05:08:47 ait sshd[986153]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 05:08:47 ait sshd[986153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.10.165.36
country_id: 2464461
description:
[2025-02-06 05:09:31 +0100] info [webmaild] 197.10.165.36 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.38.95.251
country_id: 953987
description:
[2025-02-06 05:09:35 +0100] info [webmaild] 102.38.95.251 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 05:10:38 ait sshd[987065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.117.137.181
country_id: 3865483
description:
[2025-02-06 05:10:05 +0100] info [webmaild] 181.117.137.181 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 05:10:38 ait sshd[987065]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 05:10:14 ait sshd[986999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.218.202
country_id: 3469034
description:
[2025-02-06 05:10:05 +0100] info [webmaild] 45.236.218.202 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 05:10:14 ait sshd[986999]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  6 05:11:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-06 05:11:53 dovecot_login authenticator failed for ([103.109.44.163]) [122.165.137.159]:58130: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.162.30.3
country_id: 1835841
description:
Feb  6 05:12:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.162.30.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.250.38
country_id: 3625428
description:
[2025-02-06 05:12:10 +0100] info [webmaild] 190.97.250.38 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.14.146.3
country_id: 3686110
description:
[2025-02-06 05:12:33 +0100] info [webmaild] 179.14.146.3 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.171.93.190
country_id: 3469034
description:
[2025-02-06 05:12:37 +0100] info [webmaild] 190.171.93.190 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.109.217.15
country_id: 783754
description:
Feb  6 05:12:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.109.217.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
country_id: 3175395
description:
Feb  6 05:12:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.178.178
country_id: 3469034
description:
[2025-02-06 05:12:03 +0100] info [webmaild] 177.131.178.178 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.30.3
country_id: 1835841
description:
2025-02-06 05:12:09 dovecot_login authenticator failed for ([121.162.30.3]) [121.162.30.3]:50346: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
country_id: 3175395
description:
2025-02-06 05:12:54 dovecot_login authenticator failed for net-2-36-64-247.cust.vodafonedsl.it [2.36.64.247]:42619: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.109.217.15
country_id: 783754
description:
2025-02-06 05:12:47 dovecot_plain authenticator failed for (enscompty) [192.109.217.15]:51910: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 05:12:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-02-06 05:13:12 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:32959: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.66.235.99
country_id: 2802361
description:
Feb  6 05:13:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.66.235.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.66.235.99
country_id: 2802361
description:
2025-02-06 05:13:39 dovecot_plain authenticator failed for (unateray) [87.66.235.99]:60142: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 05:13:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Feb  6 05:13:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 05:14:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 05:14:36 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:53188: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
country_id: 2661886
description:
Feb  6 05:14:41 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.112.190
country_id: 1814991
description:
Feb  6 05:14:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.112.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.112.190
country_id: 1814991
description:
2025-02-06 05:14:48 dovecot_plain authenticator failed for ([60.219.112.190]) [60.219.112.190]:60928: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
country_id: 3175395
description:
2025-02-06 05:15:00 dovecot_plain authenticator failed for (amycatic) [185.168.173.87]:47334: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 05:14:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 05:14:18 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:35871: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.228.150
country_id: 1814991
description:
Feb  6 05:14:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.228.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
country_id: 3175395
description:
Feb  6 05:14:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
country_id: 1814991
description:
2025-02-06 05:14:08 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:59820: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
country_id: 6252001
description:
Feb  6 05:14:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
country_id: 6252001
description:
2025-02-06 05:14:33 dovecot_plain authenticator failed for syn-047-037-177-099.res.spectrum.com [47.37.177.99]:40065: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.42.110.205
country_id: 3469034
description:
[2025-02-06 05:14:35 +0100] info [webmaild] 201.42.110.205 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.155.220.224
country_id: 1168579
description:
[2025-02-06 05:14:36 +0100] info [webmaild] 119.155.220.224 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
country_id: 2661886
description:
2025-02-06 05:14:43 dovecot_login authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:40838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.228.150
country_id: 1814991
description:
2025-02-06 05:14:58 dovecot_login authenticator failed for ([222.170.228.150]) [222.170.228.150]:53507: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
country_id: 1814991
description:
Feb  6 05:14:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 05:15:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config.js.bak||User:aitext01||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.81.71
country_id: 3469034
description:
[2025-02-06 05:15:11 +0100] info [webmaild] 187.84.81.71 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 05:15:31 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:48715: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.70.230
country_id: 3469034
description:
[2025-02-06 05:15:05 +0100] info [webmaild] 138.97.70.230 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 05:16:17 ait sshd[989204]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-02-06 05:16:04 dovecot_plain authenticator failed for (inicates) [65.20.133.4]:37685: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
country_id: 6252001
description:
2025-02-06 05:16:14 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:50131: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 05:16:17 ait sshd[989204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
country_id: 2017370
description:
2025-02-06 05:16:28 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:52464: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 05:16:43 ait sshd[989259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.218.215.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 05:16:43 ait sshd[989259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.218.215.240


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
country_id: 6252001
description:
Feb  6 05:16:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
country_id: 617790
description:
Feb  6 05:16:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.148.248.235
country_id: 1814991
description:
2025-02-06 05:16:39 dovecot_plain authenticator failed for ([117.148.248.235]) [117.148.248.235]:53778: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
country_id: 2017370
description:
Feb  6 05:16:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
country_id: 617790
description:
2025-02-06 05:16:27 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:52180: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.4
country_id: 99237
description:
Feb  6 05:16:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.70.128.90
country_id: 298795
description:
[2025-02-06 05:17:10 +0100] info [webmaild] 95.70.128.90 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 05:17:44 ait sshd[989501]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 05:17:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 05:17:31 ait sshd[989465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 203.223.89.235
country_id: 1210997
description:
[2025-02-06 05:17:33 +0100] info [webmaild] 203.223.89.235 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-06 05:17:34 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:47349: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.125.195
country_id: 3469034
description:
[2025-02-06 05:17:44 +0100] info [webmaild] 45.187.125.195 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.146.60.175
country_id: 3996063
description:
[2025-02-06 05:17:03 +0100] info [webmaild] 201.146.60.175 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 05:17:31 ait sshd[989465]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
country_id: 1835841
description:
2025-02-06 05:17:59 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:54480: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  6 05:17:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 05:17:44 ait sshd[989501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  6 05:19:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.95.37
country_id: 3469034
description:
[2025-02-06 05:19:33 +0100] info [webmaild] 179.189.95.37 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.132.39
country_id: 3469034
description:
[2025-02-06 05:19:41 +0100] info [webmaild] 177.37.132.39 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.212.9
country_id: 2017370
description:
Feb  6 05:19:27 ait sshd[990073]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.87.212.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.87.212.9
country_id: 2017370
description:
Feb  6 05:19:27 ait sshd[990073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.87.212.9  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-06 05:19:33 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:46066: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.98.135
country_id: 1835841
description:
Feb  6 05:19:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.122.98.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.98.135
country_id: 1835841
description:
2025-02-06 05:19:18 dovecot_plain authenticator failed for ([222.122.98.135]) [222.122.98.135]:56403: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-02-06 05:20:57 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:47456: 535 Incorrect authentication data (set_id=larm)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-20.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 05:20:08 ait sshd[990454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
country_id: 2661886
description:
2025-02-06 05:20:19 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (lastine) [188.149.132.246]:56274: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Feb  6 05:20:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Feb  6 05:20:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.165.110.40
country_id: 953987
description:
[2025-02-06 05:20:03 +0100] info [webmaild] 165.165.110.40 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 05:20:08 ait sshd[990454]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.140.121
country_id: 298795
description:
2025-02-06 05:20:15 dovecot_plain authenticator failed for (hogal) [5.26.140.121]:51353: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
country_id: 732800
description:
2025-02-06 05:20:31 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:43317: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.140.121
country_id: 298795
description:
Feb  6 05:20:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.140.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.198.109
country_id: 3469034
description:
[2025-02-06 05:20:14 +0100] info [webmaild] 187.73.198.109 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
country_id: 2661886
description:
Feb  6 05:20:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
country_id: 732800
description:
Feb  6 05:20:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-02-06 05:20:22 dovecot_plain authenticator failed for (bimbous) [102.53.15.18]:33276: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
country_id: 337996
description:
Feb  6 05:21:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.156.195.35
country_id: 1814991
description:
2025-02-06 05:22:00 dovecot_login authenticator failed for ([117.156.195.35]) [117.156.195.35]:42479: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.193.70
country_id: 1814991
description:
Feb  6 05:21:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.193.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  6 05:21:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.90.150.51
country_id: 2921044
description:
2025-02-06 05:21:25 dovecot_login authenticator failed for ip-109-090-150-051.um36.pools.vodafone-ip.de [109.90.150.51]:39816: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-06 05:21:26 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:22803: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
country_id: 2017370
description:
2025-02-06 05:21:35 dovecot_login authenticator failed for ([146.120.208.148]) [146.120.208.148]:38755: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2025-02-06 05:21:09 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:21295: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.156.195.35
country_id: 1814991
description:
Feb  6 05:21:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.156.195.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
country_id: 1605651
description:
Feb  6 05:21:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-02-06 05:21:07 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:55302: 535 Incorrect authentication data (set_id=info@aitlemass.net)


