# incident

plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:01-46.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.55.59
country_id: 1835841
description:
2025-02-07 01:47:03 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:59472: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
country_id: 1814991
description:
Feb  7 01:47:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
country_id: 1814991
description:
2025-02-07 01:47:36 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:36363: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
country_id: 1835841
description:
Feb  7 01:47:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.55.59
country_id: 1835841
description:
Feb  7 01:47:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.55.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.134
country_id: 1643084
description:
Feb  7 01:47:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  7 01:47:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-07 01:47:47 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:44124: 535 Incorrect authentication data (set_id=dm)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/js/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 01:48:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
country_id: 1835841
description:
2025-02-07 01:47:51 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:38330: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 01:48:08 ait sshd[1525014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
country_id: 2017370
description:
Feb  7 01:48:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
country_id: 2017370
description:
2025-02-07 01:48:40 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:57146: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2025-02-07 01:49:21 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:47698: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
country_id: 1814991
description:
2025-02-07 01:49:22 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:53136: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
country_id: 2017370
description:
Feb  7 01:49:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.220.235
country_id: 1814991
description:
Feb  7 01:49:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.220.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
country_id: 1814991
description:
Feb  7 01:49:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-02-07 01:49:16 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:52226: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.250.174
country_id: 1814991
description:
Feb  7 01:49:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.250.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.250.174
country_id: 1814991
description:
2025-02-07 01:49:26 dovecot_plain authenticator failed for ([117.32.250.174]) [117.32.250.174]:48624: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
country_id: 1835841
description:
Feb  7 01:49:47 ait sshd[1525558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.26.119
country_id: 3469034
description:
[2025-02-07 01:48:54 +0100] info [webmaild] 138.97.26.119 - info@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.142
country_id: 1814991
description:
2025-02-07 01:48:58 dovecot_plain authenticator failed for ([61.185.68.142]) [61.185.68.142]:56990: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.227.218
country_id: 1835841
description:
2025-02-07 01:49:20 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:56352: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
country_id: 2017370
description:
Feb  7 01:49:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
country_id: 1269750
description:
Feb  7 01:49:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.158.238
country_id: 1814991
description:
2025-02-07 01:49:09 dovecot_plain authenticator failed for ([123.116.158.238]) [123.116.158.238]:59050: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-02-07 01:49:20 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:36191: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
country_id: 1835841
description:
Feb  7 01:49:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
country_id: 1814991
description:
Feb  7 01:49:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
country_id: 3469034
description:
Feb  7 01:49:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
country_id: 1880251
description:
2025-02-07 01:49:08 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:44665: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.227.218
country_id: 1835841
description:
Feb  7 01:49:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.227.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2025-02-07 01:49:33 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:57316: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.105
country_id: 1668284
description:
Feb  7 01:49:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
country_id: 1880251
description:
Feb  7 01:49:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
country_id: 1814991
description:
2025-02-07 01:49:10 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:35380: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
country_id: 2017370
description:
2025-02-07 01:49:06 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:57672: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.158.238
country_id: 1814991
description:
Feb  7 01:49:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.158.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-02-07 01:49:11 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:42033: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
country_id: 1269750
description:
Feb  7 01:49:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
country_id: 1814991
description:
Feb  7 01:49:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
country_id: 3469034
description:
2025-02-07 01:49:27 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:39424: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/js/engine1/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.142
country_id: 1814991
description:
Feb  7 01:48:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
country_id: 1835841
description:
2025-02-07 01:49:45 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:48410: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.105
country_id: 1668284
description:
2025-02-07 01:49:45 dovecot_plain authenticator failed for 111-70-49-105.emome-ip.hinet.net [111.70.49.105]:57299: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
country_id: 2017370
description:
Feb  7 01:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
country_id: 1819730
description:
2025-02-07 01:50:33 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:43461: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
country_id: 1269750
description:
Feb  7 01:50:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.243.7.50
country_id: 1835841
description:
2025-02-07 01:50:43 dovecot_login authenticator failed for ([203.243.7.50]) [203.243.7.50]:39110: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
country_id: 6252001
description:
2025-02-07 01:50:15 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:43894: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
country_id: 630336
description:
2025-02-07 01:49:53 dovecot_plain authenticator failed for ([91.149.142.21]) [91.149.142.21]:53033: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-02-07 01:50:18 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:37792: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
country_id: 1819730
description:
Feb  7 01:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
country_id: 1814991
description:
2025-02-07 01:50:30 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:38516: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
country_id: 1269750
description:
Feb  7 01:50:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
country_id: 6252001
description:
2025-02-07 01:50:16 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:40647: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
country_id: 3175395
description:
Feb  7 01:50:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
country_id: 6252001
description:
2025-02-07 01:50:36 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:56677: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
country_id: 3175395
description:
2025-02-07 01:50:38 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:33462: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
country_id: 1814991
description:
Feb  7 01:50:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
country_id: 2017370
description:
2025-02-07 01:50:40 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:53262: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
country_id: 1819730
description:
Feb  7 01:50:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.26
country_id: 1861060
description:
2025-02-07 01:49:53 dovecot_login authenticator failed for (ADMIN) [149.22.87.26]:55068: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
country_id: 2017370
description:
Feb  7 01:50:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2025-02-07 01:50:18 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:44348: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-07 01:50:32 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:40174: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
country_id: 2017370
description:
2025-02-07 01:50:33 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:49246: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.207.50
country_id: 3017382
description:
Feb  7 01:50:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.207.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/js/engine1/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
country_id: 1835841
description:
Feb  7 01:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-07 01:50:33 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:57464: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2025-02-07 01:50:33 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:34700: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
country_id: 630336
description:
Feb  7 01:49:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
country_id: 1835841
description:
Feb  7 01:50:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.42.79.74
country_id: 203312
description:
2025-02-07 01:50:29 dovecot_login authenticator failed for ([206.42.79.74]) [206.42.79.74]:48072: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
country_id: 1814991
description:
Feb  7 01:50:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.46.114
country_id: 1269750
description:
Feb  7 01:50:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.46.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Feb  7 01:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  7 01:50:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-07 01:50:33 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:53186: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.46.114
country_id: 1269750
description:
2025-02-07 01:50:49 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:43250: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.242.107
country_id: 1814991
description:
2025-02-07 01:50:16 dovecot_plain authenticator failed for (85.99.244.58.adsl-pool.jlccptt.net.cn) [119.51.242.107]:51836: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
country_id: 1835841
description:
2025-02-07 01:50:19 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:37766: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
country_id: 3996063
description:
2025-02-07 01:50:32 dovecot_plain authenticator failed for ([201.98.208.115]) [201.98.208.115]:34406: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.155.16.231
country_id: 1835841
description:
2025-02-07 01:50:18 dovecot_plain authenticator failed for ([121.155.16.231]) [121.155.16.231]:52428: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.158
country_id: 1814991
description:
2025-02-07 01:50:29 dovecot_login authenticator failed for ([27.40.100.158]) [27.40.100.158]:36075: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.149.220.148
country_id: 1269750
description:
Feb  7 01:50:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.149.220.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.223
country_id: 1668284
description:
2025-02-07 01:50:17 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:59413: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
country_id: 1814991
description:
Feb  7 01:50:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
country_id: 1819730
description:
2025-02-07 01:50:21 dovecot_plain authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:19462: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
country_id: 3996063
description:
Feb  7 01:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
country_id: 1562822
description:
Feb  7 01:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
country_id: 2017370
description:
2025-02-07 01:50:31 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:46211: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
country_id: 2017370
description:
2025-02-07 01:50:10 dovecot_login authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:53568: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.177
country_id: 3865483
description:
2025-02-07 01:50:32 dovecot_plain authenticator failed for ([167.250.119.177]) [167.250.119.177]:47230: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
country_id: 6252001
description:
Feb  7 01:50:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.223
country_id: 1668284
description:
Feb  7 01:50:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 01:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.155.16.231
country_id: 1835841
description:
Feb  7 01:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.155.16.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-07 01:50:21 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:32882: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
country_id: 1835841
description:
Feb  7 01:50:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
country_id: 1814991
description:
Feb  7 01:50:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  7 01:50:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
country_id: 1835841
description:
Feb  7 01:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.63.208
country_id: 1835841
description:
2025-02-07 01:50:17 dovecot_plain authenticator failed for ([119.207.63.208]) [119.207.63.208]:57305: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
country_id: 2017370
description:
Feb  7 01:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.142.44.154
country_id: 1814991
description:
Feb  7 01:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.142.44.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2025-02-07 01:50:45 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:57242: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.70.29.205
country_id: 1880251
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-49.146.70.29.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
country_id: 1835841
description:
Feb  7 01:50:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-07 01:50:34 dovecot_plain authenticator failed for ([178.178.222.55]) [178.178.222.55]:49248: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
country_id: 6252001
description:
2025-02-07 01:50:16 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:52512: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.92.22
country_id: 3469034
description:
2025-02-07 01:50:17 dovecot_plain authenticator failed for ([186.200.92.22]) [186.200.92.22]:49068: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-02-07 01:50:17 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:36087: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
country_id: 2017370
description:
Feb  7 01:50:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Feb  7 01:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-07 01:50:32 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:59201: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 01:50:32 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:51764: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
country_id: 1835841
description:
2025-02-07 01:50:31 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:48288: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-07 01:50:35 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:40860: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-07 01:50:16 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:37686: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2025-02-07 01:50:13 dovecot_login authenticator failed for ([124.65.160.234]) [124.65.160.234]:55991: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-07 01:50:15 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:52406: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 01:50:18 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:43296: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
country_id: 1814991
description:
2025-02-07 01:50:20 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:34658: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.42.79.74
country_id: 203312
description:
Feb  7 01:50:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.42.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  7 01:50:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.24.121.89
country_id: 3175395
description:
2025-02-07 01:50:42 dovecot_plain authenticator failed for ([212.24.121.89]) [212.24.121.89]:48174: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
country_id: 2510769
description:
Feb  7 01:50:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.85.39.104
country_id: 6252001
description:
Feb  7 01:50:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.85.39.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.56.175
country_id: 1861060
description:
2025-02-07 01:50:26 dovecot_login authenticator failed for p163175-obmd01.tokyo.ocn.ne.jp [153.141.56.175]:46517: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
country_id: 6252001
description:
Feb  7 01:50:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
country_id: 3469034
description:
2025-02-07 01:50:16 dovecot_plain authenticator failed for ([191.59.192.17]) [191.59.192.17]:54078: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
country_id: 2077456
description:
2025-02-07 01:50:26 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:48319: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.177
country_id: 3865483
description:
Feb  7 01:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
country_id: 1835841
description:
Feb  7 01:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
country_id: 1269750
description:
2025-02-07 01:50:32 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:39412: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
country_id: 3923057
description:
Feb  7 01:50:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-02-07 01:50:18 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:21472: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  7 01:50:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
country_id: 1814991
description:
Feb  7 01:50:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.30.108.247
country_id: 1168579
description:
Feb  7 01:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.30.108.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
country_id: 6252001
description:
Feb  7 01:50:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
country_id: 1814991
description:
2025-02-07 01:50:37 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:40722: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.243.7.50
country_id: 1835841
description:
Feb  7 01:50:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.243.7.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
country_id: 1814991
description:
Feb  7 01:50:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.51.242.107
country_id: 1814991
description:
Feb  7 01:50:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.51.242.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.63.208
country_id: 1835841
description:
Feb  7 01:50:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.63.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.158
country_id: 1814991
description:
Feb  7 01:50:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  7 01:50:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
country_id: 3469034
description:
Feb  7 01:50:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
country_id: 2077456
description:
Feb  7 01:50:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.85.39.104
country_id: 6252001
description:
2025-02-07 01:50:26 dovecot_plain authenticator failed for ([208.85.39.104]) [208.85.39.104]:56014: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
country_id: 1269750
description:
2025-02-07 01:50:39 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:42996: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.207.50
country_id: 3017382
description:
2025-02-07 01:50:43 dovecot_plain authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:55154: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
country_id: 2017370
description:
Feb  7 01:50:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-07 01:50:19 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:34202: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
country_id: 1819730
description:
Feb  7 01:50:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 01:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
country_id: 3175395
description:
Feb  7 01:50:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
country_id: 1814991
description:
Feb  7 01:50:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
country_id: 2017370
description:
Feb  7 01:50:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
country_id: 6252001
description:
Feb  7 01:50:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.142.44.154
country_id: 1814991
description:
2025-02-07 01:50:32 dovecot_plain authenticator failed for ([211.142.44.154]) [211.142.44.154]:49737: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
country_id: 1835841
description:
2025-02-07 01:50:33 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:38827: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
country_id: 1814991
description:
2025-02-07 01:50:34 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:41390: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
country_id: 1814991
description:
2025-02-07 01:50:36 dovecot_plain authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:46160: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
country_id: 2017370
description:
Feb  7 01:50:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
country_id: 1269750
description:
Feb  7 01:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-07 01:50:17 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:53557: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Feb  7 01:50:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
country_id: 6252001
description:
2025-02-07 01:50:34 dovecot_login authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:35200: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-02-07 01:50:39 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:60950: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2025-02-07 01:50:43 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:52650: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
country_id: 3865483
description:
Feb  7 01:50:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
country_id: 1835841
description:
2025-02-07 01:50:27 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:47133: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  7 01:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
country_id: 3469034
description:
Feb  7 01:50:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-07 01:50:21 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:41708: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-07 01:50:21 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:46402: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.56.175
country_id: 1861060
description:
Feb  7 01:50:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.56.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
country_id: 99237
description:
Feb  7 01:50:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
country_id: 6252001
description:
Feb  7 01:50:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.92.22
country_id: 3469034
description:
Feb  7 01:50:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.92.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  7 01:50:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-02-07 01:50:27 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:64022: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
country_id: 99237
description:
2025-02-07 01:50:27 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:44534: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  7 01:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-02-07 01:50:35 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:46387: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
country_id: 1814991
description:
Feb  7 01:50:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-07 01:50:19 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:38376: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.108.247
country_id: 1168579
description:
2025-02-07 01:50:33 dovecot_plain authenticator failed for static-host119-30-108-247.link.net.pk [119.30.108.247]:49943: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
country_id: 1835841
description:
2025-02-07 01:50:18 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:55331: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
country_id: 1835841
description:
Feb  7 01:50:21 ait sshd[1525988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
country_id: 1814991
description:
Feb  7 01:50:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
country_id: 1814991
description:
2025-02-07 01:50:27 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:24025: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
country_id: 1814991
description:
2025-02-07 01:50:46 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:51342: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
country_id: 1269750
description:
Feb  7 01:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.149.220.148
country_id: 1269750
description:
2025-02-07 01:50:16 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.148]:54694: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
country_id: 1814991
description:
Feb  7 01:50:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
country_id: 6252001
description:
Feb  7 01:50:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
country_id: 3175395
description:
2025-02-07 01:50:35 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:35754: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.24.121.89
country_id: 3175395
description:
Feb  7 01:50:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.24.121.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
country_id: 2510769
description:
2025-02-07 01:50:13 dovecot_plain authenticator failed for ([85.62.67.73]) [85.62.67.73]:42298: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
country_id: 6252001
description:
2025-02-07 01:50:55 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:35680: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
country_id: 338010
description:
Feb  7 01:50:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
country_id: 1814991
description:
2025-02-07 01:50:58 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:60465: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
country_id: 1269750
description:
Feb  7 01:50:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
country_id: 1814991
description:
Feb  7 01:50:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
country_id: 1819730
description:
Feb  7 01:51:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
country_id: 338010
description:
2025-02-07 01:51:01 dovecot_plain authenticator failed for ([197.156.115.37]) [197.156.115.37]:59482: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  7 01:50:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
country_id: 1819730
description:
2025-02-07 01:51:02 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:26748: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
country_id: 1562822
description:
Feb  7 01:51:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.217.22
country_id: 3017382
description:
2025-02-07 01:50:55 dovecot_login authenticator failed for (ADMIN) [191.101.217.22]:47142: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
country_id: 6252001
description:
Feb  7 01:50:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 01:50:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-07 01:51:01 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:33327: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
country_id: 2661886
description:
2025-02-07 01:51:24 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:41020: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
country_id: 6252001
description:
2025-02-07 01:50:50 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:49780: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  7 01:50:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 01:50:58 dovecot_plain authenticator failed for ([27.223.100.90]) [27.223.100.90]:58874: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  7 01:51:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
country_id: 2661886
description:
Feb  7 01:51:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
country_id: 1210997
description:
Feb  7 01:50:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
country_id: 1269750
description:
2025-02-07 01:50:52 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:34896: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-07 01:50:55 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:35562: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
country_id: 6252001
description:
2025-02-07 01:50:58 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:58280: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
country_id: 1562822
description:
2025-02-07 01:51:35 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:59528: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
country_id: 3469034
description:
2025-02-07 01:50:50 dovecot_login authenticator failed for ([200.222.80.81]) [200.222.90.178]:54799: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
country_id: 6252001
description:
Feb  7 01:50:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
country_id: 1210997
description:
2025-02-07 01:50:55 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:40206: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-07 01:51:15 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:44211: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  7 01:52:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/js/engine1/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
country_id: 290557
description:
Feb  7 01:51:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
country_id: 1814991
description:
2025-02-07 01:52:28 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:36369: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-02-07 01:52:35 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:43942: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.162.197.91
country_id: 2921044
description:
Feb  7 01:52:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.162.197.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Feb  7 01:52:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
country_id: 3469034
description:
Feb  7 01:52:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Feb  7 01:52:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.190
country_id: 1269750
description:
Feb  7 01:52:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-02-07 01:52:25 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:40174: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
country_id: 1814991
description:
Feb  7 01:52:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.70.29.205
country_id: 1880251
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:01-52.146.70.29.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-07 01:52:43 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:44428: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-02-07 01:51:56 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:35890: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
country_id: 3469034
description:
2025-02-07 01:52:35 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:57378: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
country_id: 1814991
description:
2025-02-07 01:52:52 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:38320: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
country_id: 2077456
description:
Feb  7 01:53:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
country_id: 2661886
description:
2025-02-07 01:53:19 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:49041: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-53.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
country_id: 1814991
description:
2025-02-07 01:53:10 dovecot_plain authenticator failed for ([60.216.37.11]) [60.216.37.11]:55156: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
country_id: 2661886
description:
Feb  7 01:53:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-02-07 01:53:31 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:54732: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
country_id: 3996063
description:
2025-02-07 01:53:05 dovecot_plain authenticator failed for (customer-PUE-MCA-7-7.megared.net.mx) [201.132.7.7]:42345: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
country_id: 1861060
description:
2025-02-07 01:53:09 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:48348: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 01:53:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
country_id: 3865483
description:
Feb  7 01:53:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.190
country_id: 1269750
description:
2025-02-07 01:52:51 dovecot_plain authenticator failed for ([122.187.229.190]) [122.187.229.190]:56390: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
country_id: 1861060
description:
Feb  7 01:53:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
country_id: 1814991
description:
Feb  7 01:52:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
country_id: 1269750
description:
Feb  7 01:53:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
country_id: 1269750
description:
2025-02-07 01:53:25 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:51482: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
country_id: 1269750
description:
Feb  7 01:53:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/js/engine1/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
country_id: 3996063
description:
Feb  7 01:53:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
country_id: 1814991
description:
Feb  7 01:53:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Feb  7 01:53:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
country_id: 1835841
description:
Feb  7 01:53:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
country_id: 1835841
description:
2025-02-07 01:53:08 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:33819: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-02-07 01:53:08 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:57177: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-07 01:53:24 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:39517: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-02-07 01:53:28 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:52781: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
country_id: 1269750
description:
Feb  7 01:54:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
country_id: 1814991
description:
Feb  7 01:54:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.133.79.69
country_id: 1814991
description:
Feb  7 01:54:16 ait sshd[1527473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.133.79.69  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.210.170
country_id: 1814991
description:
Feb  7 01:54:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.210.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.176.50
country_id: 1814991
description:
Feb  7 01:54:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.176.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.176.50
country_id: 1814991
description:
2025-02-07 01:54:46 dovecot_plain authenticator failed for ([124.115.176.50]) [124.115.176.50]:38425: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
country_id: 1835841
description:
2025-02-07 01:54:46 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:50092: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-07 01:54:11 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:4511: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
country_id: 1269750
description:
Feb  7 01:54:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
country_id: 1814991
description:
2025-02-07 01:54:31 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:25963: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.210.170
country_id: 1814991
description:
2025-02-07 01:54:39 dovecot_plain authenticator failed for ([113.64.210.170]) [113.64.210.170]:32782: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
country_id: 6252001
description:
Feb  7 01:54:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
country_id: 2510769
description:
Feb  7 01:54:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
country_id: 1819730
description:
Feb  7 01:54:04 ait sshd[1527351]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
country_id: 1819730
description:
Feb  7 01:54:04 ait sshd[1527351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
country_id: 6252001
description:
2025-02-07 01:54:10 dovecot_plain authenticator failed for ([65.76.106.187]) [65.76.106.187]:37506: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
country_id: 1269750
description:
2025-02-07 01:54:30 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:40760: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
country_id: 1269750
description:
2025-02-07 01:54:02 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:56070: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
country_id: 1835841
description:
Feb  7 01:54:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
country_id: 1562822
description:
Feb  7 01:55:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 01:55:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
country_id: 102358
description:
Feb  7 01:55:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-02-07 01:55:01 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:50059: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
country_id: 1562822
description:
2025-02-07 01:55:05 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:34364: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
country_id: 102358
description:
2025-02-07 01:55:02 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:38786: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
country_id: 1269750
description:
Feb  7 01:55:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
country_id: 1269750
description:
2025-02-07 01:55:16 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:52454: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.133.79.69
country_id: 1814991
description:
Feb  7 01:54:52 ait sshd[1527578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.133.79.69  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.1.60
country_id: 1835841
description:
Feb  7 01:54:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.1.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 113.161.253.230
country_id: 1562822
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:01-56.113.161.253.230


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:01-56.35.92.116.235


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.100.236.96
country_id: 3469034
description:
[2025-02-07 01:56:13 +0100] info [webmaild] 177.100.236.96 - info@jaster.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 01:56:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/index.php


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.124.95.130
country_id: 2750405
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:01-56.94.124.95.130


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
country_id: 798549
description:
Feb  7 01:57:00 ait sshd[1528699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
country_id: 798549
description:
Feb  7 01:57:00 ait sshd[1528699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 01:57:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.99
country_id: 1835841
description:
Feb  7 01:57:53 ait sshd[1528952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
country_id: 1819730
description:
Feb  7 01:58:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/engine1/engine1/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.99
country_id: 1835841
description:
Feb  7 01:57:53 ait sshd[1528952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 01:59:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
country_id: 1269750
description:
Feb  7 01:59:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
country_id: 1819730
description:
2025-02-07 01:58:51 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:43866: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 01:58:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-02-07 01:59:17 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:51600: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/engine1/engine1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
country_id: 6252001
description:
2025-02-07 02:00:35 dovecot_login authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:61958: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
country_id: 6252001
description:
2025-02-07 02:00:44 dovecot_login authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:40550: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 02:00:03 ait sshd[1529806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 02:00:03 ait sshd[1529806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
country_id: 6252001
description:
Feb  7 02:00:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
country_id: 6252001
description:
Feb  7 02:00:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 02:00:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/engine1/js/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2025-02-07 02:01:05 dovecot_plain authenticator failed for ([101.13.4.119]) [101.13.4.119]:35208: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.176
country_id: 1269750
description:
Feb  7 02:01:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-02-07 02:01:44 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:50702: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
country_id: 1814991
description:
2025-02-07 02:01:45 dovecot_plain authenticator failed for ([183.134.209.86]) [183.134.209.86]:44684: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
country_id: 2403846
description:
2025-02-07 02:00:52 dovecot_login authenticator failed for ([102.223.154.170]) [102.223.154.170]:39600: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Feb  7 02:01:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-07 02:01:42 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:54390: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
country_id: 2403846
description:
Feb  7 02:00:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
country_id: 2661886
description:
Feb  7 02:01:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  7 02:01:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
country_id: 2017370
description:
Feb  7 02:01:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
country_id: 1814991
description:
2025-02-07 02:01:44 dovecot_plain authenticator failed for ([111.207.231.67]) [111.207.231.65]:64528: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
country_id: 1269750
description:
Feb  7 02:01:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-07 02:01:25 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:41896: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.108
country_id: 6252001
description:
Feb  7 02:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
country_id: 298795
description:
2025-02-07 02:01:40 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:58954: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
country_id: 1269750
description:
Feb  7 02:01:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
country_id: 3469034
description:
Feb  7 02:01:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
country_id: 1269750
description:
2025-02-07 02:01:02 dovecot_login authenticator failed for ([115.244.25.186]) [103.156.208.66]:42458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.108
country_id: 6252001
description:
2025-02-07 02:01:32 dovecot_plain authenticator failed for (static-76-77-25-108.networklubbock.net) [76.77.25.108]:40283: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2025-02-07 02:01:45 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:56078: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-02-07 02:01:12 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:56568: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-02-07 02:01:15 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:37130: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  7 02:01:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
country_id: 1835841
description:
Feb  7 02:01:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
country_id: 1819730
description:
2025-02-07 02:01:36 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:1680: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
country_id: 1819730
description:
Feb  7 02:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-07 02:01:44 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:38550: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.176
country_id: 1269750
description:
2025-02-07 02:01:43 dovecot_plain authenticator failed for (nsg-corporate-176.229.187.122.airtel.in) [122.187.229.176]:60059: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
country_id: 1668284
description:
Feb  7 02:01:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-07 02:01:44 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:42283: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
country_id: 337996
description:
Feb  7 02:01:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.112.141.230
country_id: 2750405
description:
Feb  7 02:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.112.141.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
country_id: 1814991
description:
Feb  7 02:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
country_id: 1814991
description:
Feb  7 02:01:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
country_id: 1819730
description:
Feb  7 02:01:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
country_id: 1643084
description:
Feb  7 02:01:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
country_id: 1814991
description:
2025-02-07 02:01:45 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:50261: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
country_id: 1835841
description:
2025-02-07 02:01:46 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:34812: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
country_id: 1269750
description:
2025-02-07 02:01:48 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:44766: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
country_id: 1880251
description:
Feb  7 02:01:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
country_id: 1880251
description:
2025-02-07 02:01:31 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:39258: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
country_id: 6252001
description:
Feb  7 02:01:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-02-07 02:01:43 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:45486: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2025-02-07 02:01:16 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:42106: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-07 02:01:33 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:42348: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
country_id: 1819730
description:
Feb  7 02:01:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
country_id: 3469034
description:
2025-02-07 02:01:46 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:50660: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
country_id: 1819730
description:
2025-02-07 02:01:48 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:37765: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  7 02:01:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
country_id: 298795
description:
Feb  7 02:01:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
country_id: 6252001
description:
2025-02-07 02:01:42 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:37674: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
country_id: 1269750
description:
Feb  7 02:01:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
country_id: 1269750
description:
Feb  7 02:01:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
country_id: 1269750
description:
2025-02-07 02:01:42 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:44099: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.134.209.86
country_id: 1814991
description:
Feb  7 02:01:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.134.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
country_id: 6252001
description:
Feb  7 02:02:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
country_id: 1819730
description:
2025-02-07 02:02:42 dovecot_login authenticator failed for (m121-202-152-23.smartone.com) [121.202.152.23]:62923: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.59.203
country_id: 2658434
description:
2025-02-07 02:01:58 dovecot_plain authenticator failed for (dyn-cable-cust.203.59.202.213.quicknet.ch) [213.202.59.203]:43838: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.237.101
country_id: 1814991
description:
2025-02-07 02:02:06 dovecot_plain authenticator failed for ([120.237.237.101]) [120.237.237.101]:60174: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/engine1/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
country_id: 1814991
description:
2025-02-07 02:02:01 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:59567: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.34
country_id: 1562822
description:
Feb  7 02:02:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.237.101
country_id: 1814991
description:
Feb  7 02:02:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.237.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
country_id: 878675
description:
Feb  7 02:02:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
country_id: 3996063
description:
2025-02-07 02:02:06 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:48094: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
country_id: 1814991
description:
2025-02-07 02:02:12 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:60026: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-02-07 02:02:16 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:40552: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
country_id: 1835841
description:
Feb  7 02:01:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.227.218
country_id: 1835841
description:
Feb  7 02:02:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.227.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.83.45.201
country_id: 3017382
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:02-02.51.83.45.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.175.102
country_id: 1814991
description:
Feb  7 02:01:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.175.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.81.140.83
country_id: 1814991
description:
2025-02-07 02:01:59 dovecot_plain authenticator failed for ([42.81.140.83]) [42.81.140.83]:54740: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.175.102
country_id: 1814991
description:
2025-02-07 02:02:01 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.175.102]:29494: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.127.40.19
country_id: 1210997
description:
2025-02-07 02:02:37 dovecot_login authenticator failed for (115.127.40.33.bracnet.net) [115.127.40.19]:18961: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.23
country_id: 1819730
description:
Feb  7 02:02:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-07 02:01:56 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:48174: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.81.140.83
country_id: 1814991
description:
Feb  7 02:01:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.81.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
country_id: 6252001
description:
Feb  7 02:01:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
country_id: 2403846
description:
2025-02-07 02:01:59 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:59998: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.127.40.19
country_id: 1210997
description:
Feb  7 02:02:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.127.40.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.202.59.203
country_id: 2658434
description:
Feb  7 02:01:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.202.59.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
country_id: 6252001
description:
2025-02-07 02:02:06 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:34810: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.151.20
country_id: 1733045
description:
Feb  7 02:02:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.151.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.215.241
country_id: 1814991
description:
Feb  7 02:02:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.215.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.215.241
country_id: 1814991
description:
2025-02-07 02:02:04 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:48290: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-07 02:01:55 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:43026: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
country_id: 1562822
description:
2025-02-07 02:02:32 dovecot_login authenticator failed for ([171.244.63.34]) [171.244.63.34]:46643: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
country_id: 878675
description:
2025-02-07 02:02:07 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:44326: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
country_id: 2017370
description:
2025-02-07 02:01:58 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:51102: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-02-07 02:01:59 dovecot_plain authenticator failed for ([47.206.63.169]) [47.206.63.169]:57810: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.227.218
country_id: 1835841
description:
2025-02-07 02:02:04 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:37046: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  7 02:01:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
country_id: 1819730
description:
Feb  7 02:01:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
country_id: 1814991
description:
Feb  7 02:01:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-07 02:02:03 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:51209: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
country_id: 1835841
description:
2025-02-07 02:01:53 dovecot_plain authenticator failed for ([123.212.20.131]) [123.212.20.131]:50122: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
country_id: 2403846
description:
Feb  7 02:01:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  7 02:01:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
country_id: 3469034
description:
Feb  7 02:02:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.20
country_id: 1733045
description:
2025-02-07 02:02:12 dovecot_plain authenticator failed for ([49.124.151.20]) [49.124.151.20]:39784: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
country_id: 2017370
description:
Feb  7 02:01:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
country_id: 1819730
description:
2025-02-07 02:01:55 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:3628: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
country_id: 1814991
description:
Feb  7 02:02:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
country_id: 1835841
description:
2025-02-07 02:02:05 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:48652: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
country_id: 1835841
description:
Feb  7 02:02:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
country_id: 6252001
description:
Feb  7 02:02:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.76.106.226
country_id: 3996063
description:
Feb  7 02:02:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.76.106.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/engine1/images/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.41.40
country_id: 2017370
description:
2025-02-07 02:02:54 dovecot_login authenticator failed for ([178.176.41.40]) [178.176.41.40]:49735: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 02:03:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 02:03:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.176.41.40
country_id: 2017370
description:
Feb  7 02:02:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.176.41.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.164
country_id: 99237
description:
Feb  7 02:03:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.233.203.220
country_id: 617790
description:
Feb  7 02:03:45 ait sshd[1531352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.233.203.220  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
country_id: 1835841
description:
Feb  7 02:04:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.204.125.125
country_id: 1835841
description:
2025-02-07 02:04:05 dovecot_plain authenticator failed for ([210.204.125.125]) [210.204.125.125]:60723: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
country_id: 1814991
description:
2025-02-07 02:04:16 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:58898: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.204.125.125
country_id: 1835841
description:
Feb  7 02:04:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.204.125.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
country_id: 1269750
description:
Feb  7 02:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Feb  7 02:04:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-07 02:04:41 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:21188: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2025-02-07 02:04:42 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:39859: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
country_id: 1269750
description:
2025-02-07 02:04:25 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:60788: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
country_id: 3469034
description:
2025-02-07 02:04:29 dovecot_plain authenticator failed for ([45.168.168.78]) [45.168.168.78]:48499: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
country_id: 3469034
description:
Feb  7 02:04:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/engine1/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.115.206
country_id: 732800
description:
Feb  7 02:05:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.115.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-02-07 02:05:43 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:39146: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.143
country_id: 1668284
description:
2025-02-07 02:06:10 dovecot_plain authenticator failed for 111-70-28-143.emome-ip.hinet.net [111.70.28.143]:38589: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
country_id: 1814991
description:
2025-02-07 02:06:23 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:27368: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
country_id: 1814991
description:
Feb  7 02:06:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.233.203.220
country_id: 617790
description:
Feb  7 02:06:24 ait sshd[1532640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.233.203.220  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.210.170
country_id: 1814991
description:
Feb  7 02:06:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.210.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.210.170
country_id: 1814991
description:
2025-02-07 02:06:29 dovecot_plain authenticator failed for ([113.64.210.170]) [113.64.210.170]:41062: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
country_id: 1835841
description:
Feb  7 02:05:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.28.143
country_id: 1668284
description:
Feb  7 02:06:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.28.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
country_id: 1835841
description:
2025-02-07 02:06:33 dovecot_plain authenticator failed for ([14.6.16.137]) [14.6.16.137]:53692: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/engine1/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 02:05:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.16.137
country_id: 1835841
description:
Feb  7 02:06:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.6.16.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
country_id: 1835841
description:
2025-02-07 02:06:00 dovecot_login authenticator failed for ([115.23.23.103]) [115.23.23.103]:60456: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:02-06.35.92.116.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.83.162
country_id: 2661886
description:
Feb  7 02:07:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.83.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.230.83.162
country_id: 2661886
description:
2025-02-07 02:07:31 dovecot_plain authenticator failed for 81-230-83-162-no600.tbcn.telia.com (berefiston) [81.230.83.162]:33911: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/js/engine1/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  7 02:07:09 ait sshd[1533070]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.84.154.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  7 02:07:09 ait sshd[1533070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.84.154.106


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.252.156.102
country_id: 3686110
description:
[2025-02-07 02:08:22 +0100] info [webmaild] 38.252.156.102 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-08.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-07 02:08:44 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:40514: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/js/engine1/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.241.147
country_id: 3625428
description:
[2025-02-07 02:08:02 +0100] info [webmaild] 190.114.241.147 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.51.211
country_id: 2017370
description:
2025-02-07 02:08:17 dovecot_login authenticator failed for ([5.59.51.211]) [5.59.51.211]:53852: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.112
country_id: 1880251
description:
2025-02-07 02:08:26 dovecot_login authenticator failed for (ADMIN) [156.146.57.112]:48082: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
country_id: 1814991
description:
Feb  7 02:08:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
country_id: 1819730
description:
Feb  7 02:09:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
country_id: 1819730
description:
2025-02-07 02:09:24 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:56662: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
country_id: 3469034
description:
2025-02-07 02:09:41 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:59500: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.210.180
country_id: 2017370
description:
Feb  7 02:08:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.210.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
country_id: 2017370
description:
2025-02-07 02:08:54 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:53567: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
country_id: 3469034
description:
Feb  7 02:09:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 02:08:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 02:09:57 ait sshd[1533837]: Invalid user universitypublishing from 222.122.179.118 port 57324


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 02:09:58 ait sshd[1533837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
country_id: 1814991
description:
Feb  7 02:10:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 02:10:10 ait sshd[1534232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
country_id: 798549
description:
Feb  7 02:10:31 ait sshd[1534388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/engine1/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
country_id: 1835841
description:
Feb  7 02:09:58 ait sshd[1533837]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  7 02:10:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
country_id: 798549
description:
Feb  7 02:10:31 ait sshd[1534388]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
country_id: 2017370
description:
Feb  7 02:10:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 02:09:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 02:10:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
country_id: 1814991
description:
2025-02-07 02:10:09 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:39876: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 02:10:10 ait sshd[1534232]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-07 02:10:21 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:13758: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2025-02-07 02:11:02 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:32994: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.208.245
country_id: 1819730
description:
Feb  7 02:11:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.208.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.208.245
country_id: 1819730
description:
2025-02-07 02:11:05 dovecot_plain authenticator failed for (m121-202-208-245.smartone.com) [121.202.208.245]:38217: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/engine1/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
country_id: 1269750
description:
Feb  7 02:11:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
country_id: 1269750
description:
2025-02-07 02:11:39 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:45928: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
country_id: 2017370
description:
2025-02-07 02:10:50 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:25136: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Feb  7 02:11:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.139.137
country_id: 6252001
description:
Feb  7 02:11:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.139.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.139.137
country_id: 6252001
description:
2025-02-07 02:11:16 dovecot_login authenticator failed for (c-50-190-139-137.unallocated.comcastbusiness.net) [50.190.139.137]:42121: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-07 02:12:09 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:40054: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
country_id: 1835841
description:
2025-02-07 02:12:42 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:47114: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/js/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  7 02:11:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  7 02:12:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
country_id: 1835841
description:
Feb  7 02:12:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-07 02:11:53 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:6588: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-02-07 02:11:55 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:43758: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
country_id: 1562822
description:
Feb  7 02:11:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
country_id: 1819730
description:
Feb  7 02:12:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
country_id: 1819730
description:
2025-02-07 02:12:24 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:36357: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
country_id: 1814991
description:
Feb  7 02:12:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
country_id: 1814991
description:
2025-02-07 02:12:55 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:54474: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.38.121
country_id: 1814991
description:
Feb  7 02:13:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.38.121
country_id: 1814991
description:
2025-02-07 02:13:21 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.38.121]:46623: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/engine1/engine1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  7 02:13:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-07 02:13:32 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:60089: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  7 02:13:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-07 02:13:47 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (undowith) [91.56.31.167]:62519: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-02-07 02:13:57 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:45209: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
country_id: 6252001
description:
Feb  7 02:14:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.245
country_id: 1512440
description:
[2025-02-07 02:14:16 +0100] info [webmaild] 213.230.86.245 - info@ait.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
country_id: 6252001
description:
Feb  7 02:14:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.153.250
country_id: 6252001
description:
Feb  7 02:14:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.153.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
country_id: 1819730
description:
Feb  7 02:14:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  7 02:14:46 ait sshd[1535950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
country_id: 3469034
description:
Feb  7 02:14:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
country_id: 6252001
description:
2025-02-07 02:14:03 dovecot_login authenticator failed for ([47.149.190.181]) [47.149.190.181]:54107: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
country_id: 3469034
description:
2025-02-07 02:14:04 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:44713: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.153.250
country_id: 6252001
description:
2025-02-07 02:14:15 dovecot_plain authenticator failed for 140.82.153.250.360broadband.net [140.82.153.250]:36766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  7 02:14:46 ait sshd[1535950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
country_id: 1269750
description:
Feb  7 02:14:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
country_id: 6252001
description:
2025-02-07 02:14:12 dovecot_login authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:34571: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
country_id: 1835841
description:
2025-02-07 02:14:15 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:50060: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
country_id: 6252001
description:
2025-02-07 02:14:08 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:14985: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
country_id: 1819730
description:
2025-02-07 02:14:20 dovecot_plain authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:56398: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
country_id: 1269750
description:
2025-02-07 02:14:34 dovecot_login authenticator failed for (nsg-static-250.173.71.182.airtel.in) [182.71.173.250]:51042: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
country_id: 6252001
description:
Feb  7 02:14:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-02-07 02:14:49 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:56856: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
country_id: 99237
description:
Feb  7 02:13:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
country_id: 1835841
description:
Feb  7 02:14:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.152.99.171
country_id: 6252001
description:
Feb  7 02:14:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.152.99.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  7 02:14:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-07 02:14:17 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:40532: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  7 02:14:51 ait sshd[1535968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  7 02:14:51 ait sshd[1535968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
country_id: 2328926
description:
Feb  7 02:15:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
country_id: 1819730
description:
Feb  7 02:15:06 ait sshd[1536270]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/engine1/js/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
country_id: 2328926
description:
2025-02-07 02:15:02 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:49176: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
country_id: 1819730
description:
Feb  7 02:15:06 ait sshd[1536270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188  user=operator


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.128.5
country_id: 6252001
description:
Feb  7 02:16:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.128.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
country_id: 1880251
description:
2025-02-07 02:16:22 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2236: 535 Incorrect authentication data (set_id=mappiah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:02-16.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
country_id: 6252001
description:
2025-02-07 02:16:10 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:46588: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
country_id: 1880251
description:
Feb  7 02:16:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 02:17:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
country_id: 1814991
description:
2025-02-07 02:17:39 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:50854: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
country_id: 3469034
description:
2025-02-07 02:17:40 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:36665: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
country_id: 3469034
description:
2025-02-07 02:17:06 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:41064: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/js/engine1/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 02:17:07 ait sshd[1537076]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
country_id: 1814991
description:
Feb  7 02:17:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
country_id: 1814991
description:
Feb  7 02:17:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
country_id: 1814991
description:
Feb  7 02:17:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.230.179
country_id: 3469034
description:
Feb  7 02:17:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.230.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
country_id: 3469034
description:
Feb  7 02:17:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 02:17:07 ait sshd[1537076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
country_id: 1814991
description:
2025-02-07 02:17:19 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:60217: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
country_id: 1814991
description:
2025-02-07 02:17:22 dovecot_plain authenticator failed for ([39.165.154.222]) [39.165.154.222]:54612: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  7 02:17:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-07 02:17:42 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:36240: 535 Incorrect authentication data (set_id=masomani)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/js/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
country_id: 1835841
description:
Feb  7 02:19:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
country_id: 1835841
description:
2025-02-07 02:19:44 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:54298: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
country_id: 6252001
description:
Feb  7 02:19:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 02:19:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
country_id: 6252001
description:
2025-02-07 02:19:11 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:60060: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
country_id: 1835841
description:
2025-02-07 02:19:27 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:53108: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
country_id: 1819730
description:
2025-02-07 02:19:37 dovecot_login authenticator failed for (m121-202-152-165.smartone.com) [121.202.152.165]:46774: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
country_id: 1819730
description:
Feb  7 02:19:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
country_id: 6252001
description:
2025-02-07 02:19:48 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:58342: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Feb  7 02:19:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
country_id: 1835841
description:
Feb  7 02:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
country_id: 192950
description:
Feb  7 02:19:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
country_id: 192950
description:
2025-02-07 02:19:30 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:54282: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/js/engine1/js/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
country_id: 6252001
description:
Feb  7 02:19:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2025-02-07 02:19:36 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:42886: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
country_id: 3469034
description:
Feb  7 02:20:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  7 02:20:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
country_id: 3469034
description:
2025-02-07 02:20:12 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:45048: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-07 02:20:34 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:37455: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
country_id: 1814991
description:
Feb  7 02:19:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-07 02:20:38 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:58819: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
country_id: 2661886
description:
Feb  7 02:20:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.204.19
country_id: 99237
description:
[2025-02-07 02:20:13 +0100] info [webmaild] 37.238.204.19 - info@ait-edu.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  7 02:20:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
country_id: 2661886
description:
2025-02-07 02:20:44 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:44884: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2025-02-07 02:19:52 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:50446: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
country_id: 732800
description:
Feb  7 02:21:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
country_id: 732800
description:
2025-02-07 02:21:07 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:32132: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 02:20:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  7 02:21:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 02:21:23 ait sshd[1538737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
country_id: 1835841
description:
Feb  7 02:20:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-07 02:21:07 dovecot_login authenticator failed for ([179.125.124.14]) [179.125.124.14]:60237: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 02:21:23 ait sshd[1538737]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 02:20:52 dovecot_login authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:45672: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
country_id: 1835841
description:
2025-02-07 02:20:57 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:43594: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  7 02:21:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-07 02:21:22 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:47709: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
country_id: 1835841
description:
Feb  7 02:21:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
country_id: 1835841
description:
2025-02-07 02:21:03 dovecot_plain authenticator failed for ([183.123.27.87]) [183.123.27.87]:58504: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/js/js/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.184
country_id: 6252001
description:
2025-02-07 02:22:30 dovecot_login authenticator failed for (ADMIN) [79.127.132.184]:54526: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.23.131.236
country_id: 2464461
description:
[2025-02-07 02:22:34 +0100] info [webmaild] 197.23.131.236 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  7 02:23:15 ait sshd[1539409]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  7 02:23:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-07 02:23:26 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (unmenesed) [92.244.126.105]:47775: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-23.80.76.51.123


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
country_id: 1835841
description:
Feb  7 02:23:15 ait sshd[1539409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.149
country_id: 3996063
description:
2025-02-07 02:23:56 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.149]:18107: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
country_id: 290557
description:
2025-02-07 02:24:27 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:41601: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
country_id: 2464461
description:
Feb  7 02:24:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
country_id: 1562822
description:
2025-02-07 02:24:43 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:57064: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.149
country_id: 3996063
description:
Feb  7 02:23:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  7 02:24:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  7 02:24:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
country_id: 290557
description:
Feb  7 02:24:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-02-07 02:24:31 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:57651: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
country_id: 1819730
description:
Feb  7 02:24:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
country_id: 1819730
description:
2025-02-07 02:24:40 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:2469: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
country_id: 1562822
description:
Feb  7 02:24:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/images/js/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-07 02:24:12 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:39560: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-07 02:24:26 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:59437: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
country_id: 1814991
description:
Feb  7 02:24:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
country_id: 1814991
description:
2025-02-07 02:24:42 dovecot_login authenticator failed for ([106.12.254.47]) [106.12.254.47]:49921: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.156.44
country_id: 1861060
description:
Feb  7 02:25:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.156.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
country_id: 1814991
description:
2025-02-07 02:25:34 dovecot_plain authenticator failed for ([218.92.230.86]) [218.92.230.86]:57658: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
country_id: 1835841
description:
Feb  7 02:24:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 02:24:53 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:46797: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.196.11
country_id: 3469034
description:
[2025-02-07 02:25:06 +0100] info [webmaild] 45.172.196.11 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
country_id: 3469034
description:
Feb  7 02:25:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 02:25:41 ait sshd[1540319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 02:25:41 ait sshd[1540319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.156.44
country_id: 1861060
description:
2025-02-07 02:25:46 dovecot_plain authenticator failed for p247044-obmd01.tokyo.ocn.ne.jp [153.141.156.44]:40322: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/js/engine1/images/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.230.86
country_id: 1814991
description:
Feb  7 02:25:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.230.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
country_id: 3469034
description:
2025-02-07 02:25:20 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.156.14]:38216: 535 Incorrect authentication data (set_id=rnunator)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:02-26.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
country_id: 6251999
description:
2025-02-07 02:26:16 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:53723: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-02-07 02:26:21 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:37418: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.130
country_id: 1814991
description:
2025-02-07 02:26:33 dovecot_plain authenticator failed for ([39.152.196.130]) [39.152.196.130]:56803: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
country_id: 1835841
description:
Feb  7 02:26:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
country_id: 617790
description:
2025-02-07 02:26:00 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:53252: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
country_id: 1814991
description:
Feb  7 02:26:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.123
country_id: 1819730
description:
Feb  7 02:26:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
country_id: 617790
description:
Feb  7 02:25:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
country_id: 1814991
description:
2025-02-07 02:26:10 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:53316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.130
country_id: 1814991
description:
Feb  7 02:26:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-02-07 02:26:33 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54011: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-02-07 02:26:39 dovecot_plain authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:53291: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
country_id: 1835841
description:
2025-02-07 02:26:44 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:48694: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2025-02-07 02:26:49 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:5585: 535 Incorrect authentication data (set_id=sates1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/js/js/engine1/engine1/data1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
country_id: 6251999
description:
Feb  7 02:26:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  7 02:26:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
country_id: 1819730
description:
Feb  7 02:26:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
Feb  7 02:26:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/images/js/js/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.187
country_id: 1861060
description:
2025-02-07 02:27:14 dovecot_login authenticator failed for (ADMIN) [149.22.87.187]:48316: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.66
country_id: 6252001
description:
2025-02-07 02:26:56 dovecot_login authenticator failed for ([104.241.237.66]) [104.241.237.66]:48761: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.66
country_id: 6252001
description:
Feb  7 02:26:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
country_id: 192950
description:
Feb  7 02:28:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
country_id: 192950
description:
2025-02-07 02:28:15 dovecot_login authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:42691: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  7 02:28:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-07 02:28:24 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:23368: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/engine1/js/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  7 02:29:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/engine1/js/images/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-07 02:29:00 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:37574: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2025-02-07 02:29:17 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:51960: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
country_id: 6252001
description:
2025-02-07 02:29:46 dovecot_plain authenticator failed for ([38.187.146.68]) [38.187.146.68]:45578: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
country_id: 1835841
description:
Feb  7 02:29:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-07 02:29:16 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:44585: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
country_id: 1814991
description:
Feb  7 02:29:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.252
country_id: 1835841
description:
Feb  7 02:29:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.252
country_id: 1835841
description:
2025-02-07 02:29:33 dovecot_plain authenticator failed for ([211.247.127.252]) [211.247.127.252]:43114: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
country_id: 6252001
description:
Feb  7 02:29:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  7 02:28:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-07 02:29:05 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:64202: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.178.140
country_id: 3469034
description:
[2025-02-07 02:29:11 +0100] info [webmaild] 45.190.178.140 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
country_id: 6252001
description:
Feb  7 02:30:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
country_id: 6252001
description:
Feb  7 02:30:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
country_id: 1819730
description:
2025-02-07 02:30:14 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:21735: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.115.206
country_id: 732800
description:
Feb  7 02:30:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.115.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
country_id: 2635167
description:
2025-02-07 02:30:22 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:49940: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.230.19.110
country_id: 1880251
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:02-30.52.230.19.110||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/js/engine1/js/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-02-07 02:30:24 dovecot_plain authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:34118: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.230.19.110
country_id: 1880251
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/assets/images/28c5400b0b.php||SC:/home/titlemas/public_html/AIT-EDU.US/assets


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
country_id: 1819730
description:
Feb  7 02:30:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
country_id: 6252001
description:
2025-02-07 02:30:16 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:37197: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
country_id: 2635167
description:
Feb  7 02:30:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.92.193
country_id: 2017370
description:
Feb  7 02:30:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.92.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
country_id: 2017370
description:
2025-02-07 02:30:33 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:60543: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
country_id: 6252001
description:
2025-02-07 02:30:37 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:45737: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
country_id: 3439705
description:
2025-02-07 02:31:28 dovecot_plain authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:36256: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
country_id: 1814991
description:
2025-02-07 02:31:44 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:54591: 535 Incorrect authentication data (set_id=tyeboah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 162.241.181.223
country_id: 6252001
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-30.162.241.181.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
country_id: 617790
description:
Feb  7 02:31:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  7 02:31:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-07 02:31:33 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:51664: 535 Incorrect authentication data (set_id=tsagli)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/js/js/engine1/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  7 02:31:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
country_id: 3439705
description:
Feb  7 02:31:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
country_id: 1814991
description:
Feb  7 02:31:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
country_id: 3017382
description:
Feb  7 02:31:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
country_id: 3017382
description:
2025-02-07 02:31:15 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:40456: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-07 02:31:19 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:36766: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-07 02:31:27 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:38770: 535 Incorrect authentication data (set_id=tsikpo)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/images/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.117.84
country_id: 3374766
description:
2025-02-07 02:32:07 dovecot_plain authenticator failed for ([165.90.117.84]) [165.90.117.84]:57010: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
country_id: 2017370
description:
Feb  7 02:32:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
country_id: 2542007
description:
2025-02-07 02:32:17 dovecot_plain authenticator failed for (makera) [102.53.15.54]:50384: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
country_id: 1814991
description:
2025-02-07 02:31:57 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:44312: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
country_id: 1814991
description:
Feb  7 02:31:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-07 02:32:13 dovecot_plain authenticator failed for (ammeaking) [88.87.84.104]:56938: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 02:31:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.117.84
country_id: 3374766
description:
Feb  7 02:32:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.117.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
country_id: 2542007
description:
Feb  7 02:32:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2025-02-07 02:33:28 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:42944: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-07 02:33:42 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:43313: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.27
country_id: 1668284
description:
2025-02-07 02:33:43 dovecot_plain authenticator failed for 111-70-48-27.emome-ip.hinet.net [111.70.48.27]:57623: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.48.27
country_id: 1668284
description:
Feb  7 02:33:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.48.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/images/engine1/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 144.126.218.165
country_id: 6252001
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:02-33.144.126.218.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Feb  7 02:33:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  7 02:33:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
country_id: 1835841
description:
2025-02-07 02:33:52 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:59835: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
country_id: 1814991
description:
2025-02-07 02:34:31 dovecot_plain authenticator failed for ([1.27.171.154]) [1.27.171.154]:51444: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
country_id: 1814991
description:
Feb  7 02:34:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  7 02:34:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/images/engine1/js/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  7 02:33:57 ait sshd[1543514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-07 02:34:42 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:48154: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
country_id: 1835841
description:
Feb  7 02:33:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  7 02:33:57 ait sshd[1543514]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.166.200
country_id: 1814991
description:
Feb  7 02:34:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.166.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.166.200
country_id: 1814991
description:
2025-02-07 02:34:02 dovecot_plain authenticator failed for ([183.233.166.200]) [183.233.166.200]:44742: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.31.51.158
country_id: 3469034
description:
Feb  7 02:34:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.31.51.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.51.158
country_id: 3469034
description:
2025-02-07 02:34:49 dovecot_plain authenticator failed for ([189.31.51.158]) [189.31.51.158]:40944: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
country_id: 6252001
description:
2025-02-07 02:35:32 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:42844: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
country_id: 1814991
description:
Feb  7 02:35:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
country_id: 1814991
description:
2025-02-07 02:35:37 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:51188: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
country_id: 6252001
description:
Feb  7 02:35:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
country_id: 1269750
description:
2025-02-07 02:35:18 dovecot_plain authenticator failed for ([103.170.225.80]) [103.170.225.80]:38358: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
country_id: 2661886
description:
2025-02-07 02:35:22 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:36208: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
country_id: 1562822
description:
Feb  7 02:35:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.215.163
country_id: 3469034
description:
[2025-02-07 02:35:19 +0100] info [webmaild] 45.174.215.163 - info@lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.42.79.74
country_id: 203312
description:
2025-02-07 02:35:19 dovecot_plain authenticator failed for ([206.42.79.74]) [206.42.79.74]:53171: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.136.130
country_id: 1819730
description:
2025-02-07 02:35:27 dovecot_plain authenticator failed for 14-0-136-130.static.pccw-hkt.com [14.0.136.130]:53689: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 02:35:39 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:50237: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
country_id: 1835841
description:
Feb  7 02:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
country_id: 2017370
description:
Feb  7 02:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
country_id: 2750405
description:
2025-02-07 02:35:43 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:44757: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
country_id: 1269750
description:
2025-02-07 02:35:45 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:55716: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
country_id: 3017382
description:
Feb  7 02:35:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
country_id: 2017370
description:
2025-02-07 02:35:21 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:52052: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
country_id: 1562822
description:
2025-02-07 02:35:35 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:36854: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  7 02:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
country_id: 102358
description:
2025-02-07 02:35:34 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:32886: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
country_id: 1269750
description:
2025-02-07 02:35:19 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:42106: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.5.135
country_id: 2017370
description:
Feb  7 02:35:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.5.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.5.135
country_id: 2017370
description:
2025-02-07 02:35:34 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:49450: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
country_id: 6252001
description:
2025-02-07 02:35:40 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:44520: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/images/js/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
country_id: 1269750
description:
Feb  7 02:35:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
country_id: 1880251
description:
2025-02-07 02:35:28 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:4516: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  7 02:35:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
country_id: 2661886
description:
Feb  7 02:35:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.156.159
country_id: 294640
description:
Feb  7 02:35:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.156.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
country_id: 6252001
description:
2025-02-07 02:35:39 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:46476: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-07 02:35:31 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:63330: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
country_id: 6252001
description:
Feb  7 02:35:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
country_id: 2077456
description:
2025-02-07 02:35:20 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:45932: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
country_id: 1269750
description:
Feb  7 02:35:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
country_id: 1269750
description:
Feb  7 02:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
country_id: 6252001
description:
2025-02-07 02:35:19 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:50824: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
country_id: 2017370
description:
Feb  7 02:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-07 02:35:23 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:41556: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.159
country_id: 294640
description:
2025-02-07 02:35:40 dovecot_plain authenticator failed for ([195.133.156.159]) [195.133.156.159]:48290: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
country_id: 2750405
description:
Feb  7 02:35:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Feb  7 02:35:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
country_id: 1819730
description:
Feb  7 02:35:06 ait sshd[1544037]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
country_id: 1814991
description:
2025-02-07 02:35:07 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:41180: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
country_id: 1880251
description:
Feb  7 02:35:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
country_id: 6252001
description:
Feb  7 02:35:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
country_id: 1814991
description:
2025-02-07 02:35:38 dovecot_plain authenticator failed for ([124.239.169.52]) [124.239.169.52]:34576: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
country_id: 6252001
description:
2025-02-07 02:35:41 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:51508: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-02-07 02:35:47 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:56912: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
country_id: 6252001
description:
Feb  7 02:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-07 02:35:16 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:45246: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  7 02:35:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
country_id: 1269750
description:
Feb  7 02:35:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.136.130
country_id: 1819730
description:
Feb  7 02:35:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.136.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
country_id: 102358
description:
Feb  7 02:35:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-07 02:35:19 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:43744: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
country_id: 1835841
description:
2025-02-07 02:35:21 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:55553: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
country_id: 2077456
description:
Feb  7 02:35:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  7 02:35:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
country_id: 732800
description:
Feb  7 02:35:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
country_id: 732800
description:
2025-02-07 02:35:29 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:53875: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
country_id: 6252001
description:
Feb  7 02:35:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-07 02:35:38 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:55090: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
country_id: 1819730
description:
Feb  7 02:35:06 ait sshd[1544037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
country_id: 3017382
description:
2025-02-07 02:35:15 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:47528: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
country_id: 6252001
description:
Feb  7 02:35:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
country_id: 6252001
description:
2025-02-07 02:35:18 dovecot_plain authenticator failed for ([23.237.83.130]) [23.237.83.130]:58320: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
country_id: 6252001
description:
Feb  7 02:35:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
country_id: 1814991
description:
Feb  7 02:35:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  7 02:35:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
country_id: 1269750
description:
2025-02-07 02:35:38 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:35370: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
country_id: 1814991
description:
Feb  7 02:35:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
country_id: 3175395
description:
Feb  7 02:35:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.23
country_id: 1819730
description:
Feb  7 02:35:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
country_id: 1819730
description:
2025-02-07 02:35:41 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:59546: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
country_id: 3175395
description:
2025-02-07 02:35:46 dovecot_plain authenticator failed for ([2.192.20.166]) [2.192.20.166]:49460: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.42.79.74
country_id: 203312
description:
Feb  7 02:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.42.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
country_id: 2017370
description:
2025-02-07 02:35:21 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:33494: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
country_id: 1814991
description:
Feb  7 02:36:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-07 02:36:38 dovecot_login authenticator failed for ([110.38.70.172]) [110.38.70.172]:61604: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
country_id: 1835841
description:
Feb  7 02:36:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
country_id: 1269750
description:
Feb  7 02:36:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.152
country_id: 1668284
description:
2025-02-07 02:36:44 dovecot_plain authenticator failed for 111-70-22-152.emome-ip.hinet.net [111.70.22.152]:44865: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.156.133
country_id: 294640
description:
Feb  7 02:35:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.156.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
country_id: 1835841
description:
2025-02-07 02:36:02 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:38394: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
country_id: 1269750
description:
2025-02-07 02:36:13 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:55020: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  7 02:36:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
country_id: 2661886
description:
2025-02-07 02:36:41 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:48824: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.210.93.207
country_id: 294640
description:
Feb  7 02:35:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.210.93.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-02-07 02:36:01 dovecot_plain authenticator failed for ([195.133.156.133]) [195.133.156.133]:51807: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Feb  7 02:36:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.168.195
country_id: 298795
description:
Feb  7 02:36:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.168.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2025-02-07 02:35:56 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:53722: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.63.70
country_id: 1835841
description:
Feb  7 02:36:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.63.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-02-07 02:36:32 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:41190: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.152
country_id: 1668284
description:
Feb  7 02:36:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.93.207
country_id: 294640
description:
2025-02-07 02:35:59 dovecot_plain authenticator failed for ([46.210.93.207]) [46.210.93.207]:53372: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:02-36.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-02-07 02:36:16 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:50176: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
country_id: 2661886
description:
Feb  7 02:36:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.63.70
country_id: 1835841
description:
2025-02-07 02:36:20 dovecot_plain authenticator failed for ([59.12.63.70]) [59.12.63.70]:58362: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
country_id: 2017370
description:
Feb  7 02:35:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/images/engine1/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.168.195
country_id: 298795
description:
2025-02-07 02:36:44 dovecot_login authenticator failed for ([5.11.168.195]) [5.11.168.195]:35288: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.70
country_id: 2635167
description:
Feb  7 02:36:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
country_id: 6251999
description:
2025-02-07 02:37:06 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:43673: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.70
country_id: 2635167
description:
Feb  7 02:37:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
country_id: 1814991
description:
2025-02-07 02:37:17 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:53344: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
country_id: 6252001
description:
Feb  7 02:37:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
country_id: 1814991
description:
Feb  7 02:37:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
country_id: 1814991
description:
2025-02-07 02:37:41 dovecot_plain authenticator failed for ([124.89.60.158]) [124.89.60.158]:33980: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
country_id: 3865483
description:
2025-02-07 02:37:13 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:22916: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
country_id: 2661886
description:
Feb  7 02:36:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
country_id: 2661886
description:
2025-02-07 02:36:51 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:34758: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/images/engine1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
country_id: 6251999
description:
Feb  7 02:37:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
country_id: 3865483
description:
Feb  7 02:37:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.254.225.100
country_id: 2017370
description:
Feb  7 02:37:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.254.225.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.254.225.100
country_id: 2017370
description:
2025-02-07 02:37:17 dovecot_plain authenticator failed for 100.225.254.193.infosys.su [193.254.225.100]:56364: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.70
country_id: 2635167
description:
2025-02-07 02:36:50 dovecot_login authenticator failed for (DoQjiiwQEA) [165.154.209.70]:61150: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
country_id: 1814991
description:
Feb  7 02:37:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
country_id: 1814991
description:
2025-02-07 02:37:03 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:51809: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.142.105.18
country_id: 1814991
description:
Feb  7 02:37:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.142.105.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
country_id: 6252001
description:
2025-02-07 02:37:28 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:60643: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
country_id: 6252001
description:
Feb  7 02:37:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.70
country_id: 2635167
description:
Feb  7 02:37:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
country_id: 6252001
description:
Feb  7 02:38:25 ait sshd[1545279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.68.251.222
country_id: 1562822
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-38.103.68.251.222


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
country_id: 6252001
description:
2025-02-07 02:37:51 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:58946: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/images/js/engine1/js/data1/images/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.70
country_id: 2635167
description:
2025-02-07 02:37:55 dovecot_login authenticator failed for (pGTG9CT) [165.154.209.70]:50638: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.70
country_id: 2635167
description:
Feb  7 02:38:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.70
country_id: 2635167
description:
2025-02-07 02:38:59 dovecot_login authenticator failed for (gjUa0d2) [165.154.209.70]:50892: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 02:39:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/images/js/engine1/js/data1/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.171
country_id: 1835841
description:
Feb  7 02:40:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.174.132
country_id: 1814991
description:
Feb  7 02:40:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.174.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
country_id: 3469034
description:
2025-02-07 02:40:36 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:52880: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-07 02:40:48 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:41418: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.131.60
country_id: 3686110
description:
[2025-02-07 02:40:45 +0100] info [webmaild] 201.49.131.60 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  7 02:40:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
country_id: 2017370
description:
Feb  7 02:40:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2025-02-07 02:40:28 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:56564: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
country_id: 6252001
description:
2025-02-07 02:40:33 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:45384: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.174.132
country_id: 1814991
description:
2025-02-07 02:40:33 dovecot_plain authenticator failed for ([111.26.174.132]) [111.26.174.132]:49778: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
country_id: 3175395
description:
2025-02-07 02:40:15 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:50892: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
country_id: 1814991
description:
Feb  7 02:40:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
country_id: 1814991
description:
2025-02-07 02:40:25 dovecot_plain authenticator failed for ([39.165.154.222]) [39.165.154.222]:60462: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
country_id: 2413451
description:
2025-02-07 02:40:38 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:50471: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
country_id: 3469034
description:
Feb  7 02:40:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-02-07 02:40:44 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:45008: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
country_id: 3175395
description:
Feb  7 02:40:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
country_id: 6252001
description:
Feb  7 02:40:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
country_id: 6252001
description:
Feb  7 02:40:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
country_id: 2413451
description:
Feb  7 02:40:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  7 02:40:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
country_id: 1835841
description:
2025-02-07 02:40:31 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:47892: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 02:40:32 ait sshd[1546385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
country_id: 1814991
description:
Feb  7 02:40:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 02:40:32 ait sshd[1546385]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
country_id: 6252001
description:
2025-02-07 02:40:34 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:36902: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/images/engine1/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.180.188
country_id: 3469034
description:
[2025-02-07 02:41:08 +0100] info [webmaild] 170.233.180.188 - info@ait-ext.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.246.238
country_id: 1814991
description:
Feb  7 02:41:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.246.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2025-02-07 02:41:14 dovecot_plain authenticator failed for ([218.21.246.238]) [218.21.246.238]:38776: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
country_id: 732800
description:
Feb  7 02:40:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.230
country_id: 1880251
description:
47.128.59.230 - - [07/Feb/2025:02:41:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26929273 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/?page_id=is-viagra-cheaper-in-canada" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.230


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
country_id: 2077456
description:
Feb  7 02:40:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.101.77
country_id: 1814991
description:
2025-02-07 02:40:50 dovecot_plain authenticator failed for ([112.26.101.77]) [112.26.101.77]:48231: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.0.112
country_id: 1668284
description:
Feb  7 02:40:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
country_id: 2077456
description:
2025-02-07 02:40:52 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:52944: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.0.112
country_id: 1668284
description:
2025-02-07 02:40:54 dovecot_plain authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:58060: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
country_id: 732800
description:
2025-02-07 02:40:56 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:40045: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
country_id: 690791
description:
Feb  7 02:42:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-02-07 02:42:16 dovecot_plain authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:60262: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
country_id: 690791
description:
2025-02-07 02:42:18 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (upree) [176.37.212.85]:50362: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
country_id: 1835841
description:
Feb  7 02:42:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
country_id: 1835841
description:
2025-02-07 02:42:30 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:41256: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
country_id: 2077456
description:
Feb  7 02:42:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/js/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.193.150
country_id: 290557
description:
2025-02-07 02:43:19 dovecot_login authenticator failed for (ADMIN) [217.138.193.150]:38058: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.218
country_id: 1880251
description:
47.128.22.218 - - [07/Feb/2025:02:44:37 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26805943 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?duration=short%2Cmedium&filter_course-language=183&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.218


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
country_id: 290557
description:
2025-02-07 02:44:46 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:54917: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.235.240
country_id: 6252001
description:
Feb  7 02:43:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.235.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/js/js/js/engine1/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
country_id: 290557
description:
Feb  7 02:44:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.240
country_id: 6252001
description:
2025-02-07 02:43:53 dovecot_login authenticator failed for (ADMIN) [102.129.235.240]:6551: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
country_id: 2287781
description:
2025-02-07 02:45:28 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:21185: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.158.182
country_id: 690791
description:
2025-02-07 02:45:42 dovecot_login authenticator failed for (182.158.57.37.triolan.net) [37.57.158.182]:54906: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
country_id: 2287781
description:
Feb  7 02:45:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
country_id: 1819730
description:
Feb  7 02:44:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
country_id: 1819730
description:
2025-02-07 02:45:00 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:12669: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.158.182
country_id: 690791
description:
Feb  7 02:45:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.158.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/js/js/engine1/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-02-07 02:45:56 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:48862: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
country_id: 6252001
description:
Feb  7 02:46:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
country_id: 1814991
description:
2025-02-07 02:46:04 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:44778: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
country_id: 6252001
description:
2025-02-07 02:46:05 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:53400: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
country_id: 1814991
description:
Feb  7 02:46:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
country_id: 1814991
description:
Feb  7 02:45:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
country_id: 1814991
description:
Feb  7 02:46:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 35.92.116.235
country_id: 6252001
domain: www.stiexpo.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:precious||WPU:precious||RSV:6.65||T:APACHE||MV:02-46.35.92.116.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
country_id: 1814991
description:
2025-02-07 02:46:27 dovecot_login authenticator failed for ([222.143.30.155]) [222.143.30.155]:33234: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/images/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.24.93
country_id: 1835841
description:
Feb  7 02:46:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.24.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/js/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.16.7
country_id: 1668284
description:
Feb  7 02:47:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.16.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.232.109
country_id: 3625428
description:
[2025-02-07 02:46:58 +0100] info [webmaild] 190.97.232.109 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
country_id: 1814991
description:
Feb  7 02:47:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
country_id: 1814991
description:
2025-02-07 02:47:07 dovecot_login authenticator failed for ([36.134.78.162]) [36.134.78.162]:44607: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.16.7
country_id: 1668284
description:
2025-02-07 02:47:16 dovecot_plain authenticator failed for 111-70-16-7.emome-ip.hinet.net [111.70.16.7]:55393: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.93.229.230
country_id: 1814991
description:
2025-02-07 02:47:27 dovecot_plain authenticator failed for ([218.93.229.230]) [218.93.229.230]:34755: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.24.93
country_id: 1835841
description:
2025-02-07 02:46:53 dovecot_login authenticator failed for ([218.149.24.93]) [218.149.24.93]:33708: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.93.229.230
country_id: 1814991
description:
Feb  7 02:47:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.93.229.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 02:47:26 ait sshd[1548750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 02:47:26 ait sshd[1548750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-02-07 02:48:26 dovecot_plain authenticator failed for ([122.186.174.35]) [122.186.174.35]:43606: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
country_id: 1814991
description:
Feb  7 02:48:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
country_id: 1814991
description:
2025-02-07 02:48:46 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:41829: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/images/js/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.174.35
country_id: 1269750
description:
Feb  7 02:48:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.174.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-07 02:48:55 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:55333: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  7 02:49:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  7 02:48:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
country_id: 1819730
description:
2025-02-07 02:48:53 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:36001: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-07 02:49:26 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:57704: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
country_id: 1835841
description:
Feb  7 02:49:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2025-02-07 02:49:44 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:44928: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
country_id: 1819730
description:
Feb  7 02:48:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-07 02:50:45 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:49616: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
country_id: 1269750
description:
2025-02-07 02:50:03 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:56412: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  7 02:50:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
country_id: 453733
description:
2025-02-07 02:50:13 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:33122: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-07 02:50:13 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:45770: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
country_id: 1880251
description:
Feb  7 02:50:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-02-07 02:50:24 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:33240: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.223.17
country_id: 1814991
description:
Feb  7 02:50:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.223.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
country_id: 3469034
description:
2025-02-07 02:49:52 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:46414: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
country_id: 1269750
description:
Feb  7 02:50:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
country_id: 453733
description:
Feb  7 02:50:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 02:50:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 129.222.191.190
country_id: 146669
description:
[2025-02-07 02:50:45 +0100] info [webmaild] 129.222.191.190 - info@gvu.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
country_id: 3469034
description:
Feb  7 02:49:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/js/images/js/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
country_id: 1668284
description:
Feb  7 02:50:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
country_id: 1668284
description:
2025-02-07 02:50:29 dovecot_plain authenticator failed for (58-115-53-66.twt1.com.tw) [58.115.53.66]:47999: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 02:50:34 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (redes) [87.103.126.54]:22514: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  7 02:50:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
country_id: 1643084
description:
2025-02-07 02:51:01 dovecot_login authenticator failed for ([43.252.8.34]) [43.252.8.34]:55450: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.206
country_id: 1814991
description:
Feb  7 02:51:38 ait sshd[1550228]: error: maximum authentication attempts exceeded for root from 218.92.0.206 port 34212 ssh2 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
country_id: 3469034
description:
Feb  7 02:50:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
country_id: 1269750
description:
Feb  7 02:50:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.206
country_id: 1814991
description:
Feb  7 02:51:15 ait sshd[1550228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.206  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
country_id: 1814991
description:
2025-02-07 02:51:23 dovecot_login authenticator failed for ([112.48.104.200]) [112.48.104.200]:52847: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
country_id: 1643084
description:
Feb  7 02:50:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
country_id: 3469034
description:
2025-02-07 02:50:58 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:40773: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
country_id: 1814991
description:
Feb  7 02:51:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/images/engine1/js/js/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-02-07 02:51:01 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:34276: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/images/images/engine1/js/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-07 02:53:07 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:55463: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 02:53:36 ait sshd[1550936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
country_id: 1668284
description:
Feb  7 02:53:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
country_id: 1668284
description:
2025-02-07 02:53:23 dovecot_login authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:54712: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/js/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  7 02:53:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.162.167
country_id: 3469034
description:
[2025-02-07 02:53:05 +0100] info [webmaild] 45.231.162.167 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.143.57.247
country_id: 6252001
description:
2025-02-07 02:54:26 dovecot_plain authenticator failed for ([209.143.57.247]) [209.143.57.247]:52176: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.174.142.78
country_id: 1814991
description:
Feb  7 02:54:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.174.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
country_id: 2750405
description:
Feb  7 02:54:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
country_id: 2750405
description:
2025-02-07 02:54:16 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:60632: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-02-07 02:53:54 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:33896: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
country_id: 1814991
description:
2025-02-07 02:54:10 dovecot_plain authenticator failed for ([222.174.142.78]) [222.174.142.78]:58390: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/engine1/js/js/engine1/engine1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
country_id: 3595528
description:
Feb  7 02:53:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.143.57.247
country_id: 6252001
description:
Feb  7 02:54:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.143.57.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  7 02:55:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-07 02:55:18 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:58297: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.8
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/js/engine1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.237.108
country_id: 1814991
description:
Feb  7 02:55:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2025-02-07 02:55:31 dovecot_plain authenticator failed for ([218.22.237.108]) [218.22.237.108]:34356: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
country_id: 1269750
description:
Feb  7 02:56:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
country_id: 1819730
description:
Feb  7 02:56:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
country_id: 1819730
description:
2025-02-07 02:56:32 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:61390: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
country_id: 3996063
description:
2025-02-07 02:57:09 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:53622: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 13.82.211.3
country_id: 6252001
description:
2025-02-07 02:56:15 H=(CPC-HansS-VRV94.lkynfc1jwj3ennwbquxguw4w0c.bx.internal.cloudapp.net) [13.82.211.3]:1024 F=<dpr@priv8shop.com> temporarily rejected RCPT <elproncy@yandex.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-02-07 02:56:20 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:52920: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 02:57:03 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:49810: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
country_id: 732800
description:
Feb  7 02:57:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
country_id: 3996063
description:
Feb  7 02:57:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
country_id: 1269750
description:
2025-02-07 02:56:10 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:36550: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.96.91.71
country_id: 1269750
description:
2025-02-07 02:56:56 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:36804: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.138
country_id: 1814991
description:
2025-02-07 02:56:47 dovecot_plain authenticator failed for ([119.62.184.138]) [119.62.184.138]:32916: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.91.71
country_id: 1269750
description:
Feb  7 02:56:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.96.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
country_id: 732800
description:
Feb  7 02:57:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
country_id: 732800
description:
2025-02-07 02:57:07 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:35057: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Feb  7 02:56:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.138
country_id: 1814991
description:
Feb  7 02:56:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 02:57:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
country_id: 732800
description:
2025-02-07 02:57:07 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:55865: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
country_id: 1522867
description:
Feb  7 02:57:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.52.211.19
country_id: 3595528
description:
[2025-02-07 02:58:00 +0100] info [webmaild] 38.52.211.19 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
country_id: 6252001
description:
2025-02-07 02:57:16 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:36714: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
country_id: 1835841
description:
Feb  7 02:57:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
country_id: 6252001
description:
2025-02-07 02:57:29 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:47386: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
country_id: 3017382
description:
Feb  7 02:57:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  7 02:57:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  7 02:57:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
country_id: 1835841
description:
Feb  7 02:57:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
country_id: 1668284
description:
2025-02-07 02:57:12 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-165.hinet-ip.hinet.net) [61.216.7.163]:45706: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
country_id: 1835841
description:
2025-02-07 02:57:13 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:45042: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
country_id: 1814991
description:
2025-02-07 02:57:17 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:41817: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
country_id: 1522867
description:
2025-02-07 02:57:38 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:58702: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
country_id: 1668284
description:
Feb  7 02:57:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-02-07 02:57:11 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:51807: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-07 02:57:18 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:47460: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-07 02:57:36 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:35858: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.160.6
country_id: 3865483
description:
2025-02-07 02:57:11 dovecot_plain authenticator failed for (6.160.185.190.cable.dyn.ridsa.com.ar) [190.185.160.6]:42161: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
country_id: 1835841
description:
2025-02-07 02:57:22 dovecot_plain authenticator failed for ([175.210.74.19]) [175.210.74.19]:55414: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 02:57:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
country_id: 1835841
description:
Feb  7 02:57:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
country_id: 1814991
description:
Feb  7 02:57:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.8.245
country_id: 6252001
description:
Feb  7 02:57:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.8.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  7 02:57:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
country_id: 1819730
description:
Feb  7 02:57:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.221.21
country_id: 1814991
description:
Feb  7 02:57:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-07 02:57:11 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:38498: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Feb  7 02:57:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
country_id: 1814991
description:
Feb  7 02:57:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 02:57:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
country_id: 1835841
description:
2025-02-07 02:57:30 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:37612: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Feb  7 02:57:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
country_id: 1814991
description:
Feb  7 02:57:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.141.228.9
country_id: 2017370
description:
Feb  7 02:57:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.141.228.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.141.228.9
country_id: 2017370
description:
2025-02-07 02:57:22 dovecot_plain authenticator failed for ([95.141.228.9]) [95.141.228.9]:52362: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-07 02:57:24 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:60022: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-07 02:57:31 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:39333: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
country_id: 1512440
description:
Feb  7 02:57:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  7 02:57:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
country_id: 6252001
description:
Feb  7 02:57:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Feb  7 02:57:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
country_id: 3469034
description:
Feb  7 02:57:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
country_id: 3469034
description:
2025-02-07 02:57:25 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:42054: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
country_id: 1814991
description:
2025-02-07 02:57:38 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:40980: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-02-07 02:57:34 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:40132: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
country_id: 1814991
description:
Feb  7 02:57:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
country_id: 1814991
description:
2025-02-07 02:57:11 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:27332: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  7 02:57:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-02-07 02:57:12 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:8563: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-02-07 02:57:25 dovecot_plain authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:59009: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
country_id: 1835841
description:
Feb  7 02:57:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-07 02:57:26 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:36434: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
country_id: 6251999
description:
Feb  7 02:57:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
country_id: 6252001
description:
Feb  7 02:57:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
country_id: 6252001
description:
2025-02-07 02:57:21 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:52123: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
country_id: 1814991
description:
Feb  7 02:57:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.181.1.49
country_id: 6252001
description:
Feb  7 02:57:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.181.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.129.200.113
country_id: 2077456
description:
Feb  7 02:57:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.129.200.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
country_id: 99237
description:
Feb  7 02:57:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
country_id: 1814991
description:
2025-02-07 02:57:13 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:34611: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.8.245
country_id: 6252001
description:
2025-02-07 02:57:18 dovecot_plain authenticator failed for ([65.76.8.245]) [65.76.8.245]:48044: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.200.113
country_id: 2077456
description:
2025-02-07 02:57:37 dovecot_plain authenticator failed for (115-129-200-113.tpgi.com.au) [115.129.200.113]:35275: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-02-07 02:57:37 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:60548: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 02:57:38 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:53719: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
country_id: 1814991
description:
2025-02-07 02:57:25 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:49777: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
country_id: 1814991
description:
2025-02-07 02:57:27 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:38216: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
country_id: 1819730
description:
2025-02-07 02:57:30 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:50591: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-02-07 02:57:41 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:40872: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-02-07 02:57:46 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:28312: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.160.6
country_id: 3865483
description:
Feb  7 02:57:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.160.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-07 02:57:13 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:47084: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
country_id: 1835841
description:
Feb  7 02:57:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
country_id: 1668284
description:
Feb  7 02:58:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
country_id: 1668284
description:
2025-02-07 02:58:39 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:53953: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
country_id: 1269750
description:
2025-02-07 02:58:47 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:39112: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
country_id: 1819730
description:
Feb  7 02:58:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
country_id: 6252001
description:
2025-02-07 02:59:02 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:56688: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
country_id: 1814991
description:
Feb  7 02:58:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.100.145
country_id: 1668284
description:
2025-02-07 02:58:32 dovecot_plain authenticator failed for 110-25-100-145.adsl.fetnet.net [110.25.100.145]:50227: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
country_id: 1269750
description:
Feb  7 02:58:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.201.203.220
country_id: 1835841
description:
2025-02-07 02:58:50 dovecot_login authenticator failed for ([175.201.203.220]) [175.201.203.220]:52004: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.14.135
country_id: 1668284
description:
Feb  7 02:58:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.14.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
country_id: 1819730
description:
2025-02-07 02:59:00 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:47443: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.1.50
country_id: 1814991
description:
Feb  7 02:58:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.1.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-07 02:58:45 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:48342: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.1.50
country_id: 1814991
description:
2025-02-07 02:58:43 dovecot_plain authenticator failed for ([113.140.1.50]) [113.140.1.50]:51572: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.201.203.220
country_id: 1835841
description:
Feb  7 02:58:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.201.203.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.100.145
country_id: 1668284
description:
Feb  7 02:58:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.100.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
country_id: 2077456
description:
2025-02-07 02:58:34 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:7100: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  7 02:58:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.88.43.127
country_id: 2328926
description:
[2025-02-07 02:58:56 +0100] info [webmaild] 102.88.43.127 - info@ijari.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
country_id: 1668284
description:
2025-02-07 02:58:58 dovecot_plain authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:59332: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
country_id: 6252001
description:
Feb  7 02:59:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
country_id: 2077456
description:
Feb  7 02:58:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
country_id: 1814991
description:
2025-02-07 02:58:32 dovecot_plain authenticator failed for (57.252.223.60.adsl-pool.sx.cn) [60.223.252.57]:54143: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 02:59:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.169
country_id: 1835841
description:
Feb  7 02:59:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
country_id: 1814991
description:
Feb  7 02:59:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.143.14.7
country_id: 1814991
description:
2025-02-07 02:59:12 dovecot_plain authenticator failed for ([117.143.14.7]) [117.143.14.7]:45264: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
country_id: 6251999
description:
2025-02-07 02:59:22 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:47164: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
country_id: 1835841
description:
Feb  7 02:59:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
country_id: 1835841
description:
Feb  7 02:59:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
country_id: 6252001
description:
Feb  7 02:59:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
country_id: 6252001
description:
2025-02-07 02:59:39 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:43694: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.143.14.7
country_id: 1814991
description:
Feb  7 02:59:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.143.14.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
country_id: 1835841
description:
2025-02-07 02:59:16 dovecot_login authenticator failed for ([222.106.198.35]) [222.106.198.35]:44622: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
country_id: 6251999
description:
Feb  7 02:59:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.169
country_id: 1835841
description:
2025-02-07 02:59:21 dovecot_plain authenticator failed for ([218.149.228.169]) [218.149.228.169]:52773: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2025-02-07 02:59:39 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:59134: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
country_id: 1835841
description:
2025-02-07 02:59:49 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:43278: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.206
country_id: 1814991
description:
2025-02-07 03:01:06 dovecot_login authenticator failed for ([111.61.176.206]) [111.61.176.206]:51028: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
country_id: 1814991
description:
Feb  7 03:01:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
country_id: 1814991
description:
2025-02-07 03:00:51 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:52785: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.206
country_id: 1814991
description:
Feb  7 03:01:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.179.198.239
country_id: 2464461
description:
[2025-02-07 03:00:38 +0100] info [webmaild] 196.179.198.239 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  7 03:00:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-07 03:00:45 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:20795: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
country_id: 1814991
description:
Feb  7 03:00:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2025-02-07 03:00:33 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:58906: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
country_id: 1814991
description:
Feb  7 03:00:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
country_id: 1814991
description:
2025-02-07 03:00:21 dovecot_plain authenticator failed for ([58.18.88.146]) [58.18.88.146]:51013: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
country_id: 1814991
description:
Feb  7 03:00:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
country_id: 1814991
description:
2025-02-07 03:01:43 dovecot_plain authenticator failed for ([27.40.100.131]) [27.40.100.131]:49154: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.58
country_id: 3144096
description:
2025-02-07 03:01:22 dovecot_login authenticator failed for (ADMIN) [46.246.122.58]:56722: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
country_id: 1814991
description:
Feb  7 03:01:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/js/engine1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
country_id: 1814991
description:
Feb  7 03:01:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 62.197.144.83
country_id: 2589581
domain: myait.org
description:
IM360 WAF: Interaction with fake plugin||MV:/shop/wp-content/plugins/WordPressCore/||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
country_id: 1814991
description:
2025-02-07 03:01:10 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:47304: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
country_id: 1814991
description:
2025-02-07 03:01:55 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:39672: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.204.112.147
country_id: 1814991
description:
Feb  7 03:02:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.204.112.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
country_id: 1269750
description:
Feb  7 03:02:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-02-07 03:02:40 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:56240: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.140
country_id: 1814991
description:
2025-02-07 03:02:41 dovecot_plain authenticator failed for ([27.40.100.140]) [27.40.100.140]:59918: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-07 03:02:19 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:52036: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-07 03:02:34 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:36416: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
country_id: 2017370
description:
2025-02-07 03:03:07 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:49978: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  7 03:02:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/engine1/engine1/js/engine1/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/engine1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.204.112.147
country_id: 1814991
description:
2025-02-07 03:02:22 dovecot_plain authenticator failed for ([163.204.112.147]) [163.204.112.147]:44692: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.46
country_id: 1814991
description:
2025-02-07 03:02:44 dovecot_plain authenticator failed for ([112.91.253.46]) [112.91.253.46]:47465: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-07 03:02:49 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:52465: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
country_id: 1668284
description:
2025-02-07 03:02:30 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:47458: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
country_id: 1269750
description:
Feb  7 03:02:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-02-07 03:02:53 dovecot_plain authenticator failed for ([186.239.41.74]) [186.239.41.74]:50557: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
country_id: 1269750
description:
Feb  7 03:02:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  7 03:02:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
country_id: 6252001
description:
2025-02-07 03:02:56 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:55902: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
country_id: 2017370
description:
Feb  7 03:03:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
country_id: 1835841
description:
Feb  7 03:02:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
country_id: 1668284
description:
Feb  7 03:02:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.140
country_id: 1814991
description:
Feb  7 03:02:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.46
country_id: 1814991
description:
Feb  7 03:02:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
country_id: 6252001
description:
Feb  7 03:02:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
country_id: 1835841
description:
2025-02-07 03:03:07 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:35206: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  7 03:02:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
country_id: 1269750
description:
2025-02-07 03:02:33 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:54756: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
country_id: 1168579
description:
Feb  7 03:02:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
country_id: 1269750
description:
2025-02-07 03:02:34 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:32978: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
country_id: 1168579
description:
2025-02-07 03:02:35 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:51483: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
country_id: 1835841
description:
2025-02-07 03:02:23 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:52328: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Feb  7 03:02:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
country_id: 1835841
description:
Feb  7 03:03:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
country_id: 2661886
description:
2025-02-07 03:03:14 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:58362: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
country_id: 1819730
description:
Feb  7 03:04:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
country_id: 2661886
description:
Feb  7 03:03:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  7 03:03:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-07 03:03:24 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:36078: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.158.238
country_id: 1814991
description:
Feb  7 03:03:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.158.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.158.238
country_id: 1814991
description:
2025-02-07 03:03:51 dovecot_plain authenticator failed for ([123.116.158.238]) [123.116.158.238]:50096: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
country_id: 1819730
description:
2025-02-07 03:04:02 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:41494: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  7 03:04:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/images/engine1/engine1/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
country_id: 1819730
description:
Feb  7 03:04:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
country_id: 1819730
description:
2025-02-07 03:04:33 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:31359: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-07 03:04:14 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:50167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.123.102
country_id: 1819730
description:
Feb  7 03:04:27 ait sshd[1555199]: pam_imunify(sshd:auth): [IM360_RBL] The IP 39.109.123.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 39.109.123.102
country_id: 1819730
description:
Feb  7 03:04:27 ait sshd[1555199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.109.123.102  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 03:05:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/js/js/images/engine1/js/engine1/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/js


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.202.105
country_id: 6251999
description:
Feb  7 03:05:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.202.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-07 03:05:40 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:59621: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
country_id: 2921044
description:
Feb  7 03:05:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.202.105
country_id: 6251999
description:
2025-02-07 03:05:39 dovecot_login authenticator failed for (ADMIN) [181.41.202.105]:49906: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
country_id: 2921044
description:
Feb  7 03:06:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-07 03:07:00 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:55704: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 03:06:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-07 03:07:41 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:58950: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.26.106
country_id: 1814991
description:
Feb  7 03:07:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.26.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  7 03:07:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.26.106
country_id: 1814991
description:
2025-02-07 03:08:00 dovecot_plain authenticator failed for ([58.240.26.106]) [58.240.26.106]:30850: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
country_id: 895949
description:
Feb  7 03:07:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-07 03:07:29 dovecot_plain authenticator failed for ([41.216.84.18]) [41.216.84.18]:33376: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/engine1/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.69.242.122
country_id: 1814991
description:
Feb  7 03:08:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.69.242.122 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-08.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
country_id: 1814991
description:
Feb  7 03:08:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
country_id: 1814991
description:
2025-02-07 03:08:59 dovecot_login authenticator failed for ([221.0.111.113]) [221.0.111.113]:49886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
country_id: 6252001
description:
Feb  7 03:08:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-02-07 03:08:39 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:35724: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.21.77
country_id: 1880251
description:
47.128.21.77 - - [07/Feb/2025:03:08:51 +0100] "GET /wp-content/plugins/ultimate-member/assets/css/pickadate/default.date.css?ver=2.6.7 HTTP/2.0" 200 1575 admissions.ait-edu.us "https://admissions.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15647720" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.21.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.69.242.122
country_id: 1814991
description:
2025-02-07 03:08:15 dovecot_plain authenticator failed for ([101.69.242.122]) [101.69.242.122]:43610: 535 Incorrect authentication data (set_id=eejour13)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/engine1/js/engine1/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
country_id: 1814991
description:
Feb  7 03:09:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
country_id: 1814991
description:
2025-02-07 03:09:32 dovecot_login authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:34265: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
country_id: 1819730
description:
Feb  7 03:09:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
country_id: 1819730
description:
2025-02-07 03:09:46 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:30743: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
country_id: 1819730
description:
Feb  7 03:10:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 03:10:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
country_id: 1819730
description:
2025-02-07 03:10:52 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:60287: 535 Incorrect authentication data (set_id=mssept2014)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 166.1.13.59
country_id: 6252001
domain: elibrary.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ENG23A00071Y||WPU:ENG23A00071Y||RSV:6.65||T:APACHE||MV:03-10.166.1.13.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.146.49.209
country_id: 6252001
description:
Feb  7 03:10:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.146.49.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.146.49.209
country_id: 6252001
description:
2025-02-07 03:10:38 dovecot_plain authenticator failed for ([216.146.49.209]) [216.146.49.209]:46441: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.223
country_id: 99237
description:
Feb  7 03:10:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
country_id: 1861060
description:
Feb  7 03:11:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.141.105.6
country_id: 1814991
description:
Feb  7 03:11:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.141.105.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
country_id: 1643084
description:
2025-02-07 03:12:07 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:39036: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  7 03:11:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-07 03:11:32 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:37135: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-02-07 03:11:52 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:17912: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
country_id: 1835841
description:
Feb  7 03:11:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.141.105.6
country_id: 1814991
description:
2025-02-07 03:11:20 dovecot_plain authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:60352: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
country_id: 1643084
description:
Feb  7 03:12:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/js/js/engine1/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2025-02-07 03:11:26 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:53412: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
country_id: 1835841
description:
2025-02-07 03:12:27 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:59022: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
country_id: 1835841
description:
Feb  7 03:12:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
country_id: 1269750
description:
Feb  7 03:12:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  7 03:13:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-07 03:13:10 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:28075: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/js/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-02-07 03:12:50 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:54470: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
country_id: 1562822
description:
Feb  7 03:13:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
country_id: 2017370
description:
Feb  7 03:13:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
country_id: 2017370
description:
2025-02-07 03:13:23 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:54796: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-02-07 03:13:44 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:33174: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
country_id: 1562822
description:
2025-02-07 03:13:58 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:59216: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-02-07 03:14:04 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:35810: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
country_id: 6252001
description:
Feb  7 03:14:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
country_id: 6252001
description:
2025-02-07 03:14:06 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:55076: 535 Incorrect authentication data (set_id=jpomador)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/engine1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Feb  7 03:13:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
country_id: 6252001
description:
Feb  7 03:14:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
country_id: 2328926
description:
2025-02-07 03:14:56 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:40422: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
country_id: 1814991
description:
Feb  7 03:15:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
country_id: 1819730
description:
2025-02-07 03:14:26 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:3304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
country_id: 1814991
description:
2025-02-07 03:15:07 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:35836: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/data1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 03:14:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.139.91.207
country_id: 2635167
description:
Feb  7 03:14:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.139.91.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 03:14:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
country_id: 1668284
description:
Feb  7 03:15:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
country_id: 1835841
description:
Feb  7 03:14:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
country_id: 1835841
description:
2025-02-07 03:14:16 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:32858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
country_id: 1819730
description:
Feb  7 03:14:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
country_id: 2328926
description:
Feb  7 03:14:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2025-02-07 03:15:58 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:49196: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.221.104.33
country_id: 1814991
description:
Feb  7 03:15:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.221.104.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.221.104.33
country_id: 1814991
description:
2025-02-07 03:15:24 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:34632: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.131.170.111
country_id: 3996063
description:
[2025-02-07 03:15:32 +0100] info [webmaild] 189.131.170.111 - info@aitopen.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
country_id: 3469034
description:
Feb  7 03:15:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
country_id: 1668284
description:
2025-02-07 03:15:11 dovecot_plain authenticator failed for ([58.115.53.66]) [58.115.53.66]:58966: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/data1/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-02-07 03:15:47 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:54170: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Feb  7 03:15:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.222.124.120
country_id: 2017370
description:
[2025-02-07 03:16:48 +0100] info [webmaild] 77.222.124.120 - info@university-publishing.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2025-02-07 03:16:26 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:33808: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
country_id: 3469034
description:
Feb  7 03:16:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
country_id: 3469034
description:
2025-02-07 03:16:42 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:43807: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 03:16:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
country_id: 2017370
description:
Feb  7 03:16:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-07 03:17:40 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:59520: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  7 03:17:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  7 03:17:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-07 03:17:15 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:6229: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
country_id: 1880251
description:
Feb  7 03:17:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
country_id: 1880251
description:
2025-02-07 03:17:25 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:40797: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  7 03:17:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-07 03:17:39 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:38248: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/js/engine1/engine1/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-02-07 03:18:49 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:38864: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-02-07 03:18:36 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:39208: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
country_id: 1512440
description:
Feb  7 03:18:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
country_id: 6252001
description:
2025-02-07 03:18:57 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:39226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
country_id: 1819730
description:
Feb  7 03:19:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.205
country_id: 1668284
description:
Feb  7 03:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-02-07 03:19:05 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:37646: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/engine1/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
country_id: 3932488
description:
Feb  7 03:18:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
country_id: 1819730
description:
2025-02-07 03:19:05 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:1651: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-07 03:19:02 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:37465: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
country_id: 1269750
description:
2025-02-07 03:19:07 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:33822: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-02-07 03:18:23 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:42968: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  7 03:19:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.119
country_id: 1831722
description:
2025-02-07 03:18:58 dovecot_login authenticator failed for (ADMIN) [188.215.235.119]:57398: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
country_id: 2921044
description:
2025-02-07 03:19:02 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:39275: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-02-07 03:18:26 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:39648: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
country_id: 1814991
description:
2025-02-07 03:18:48 dovecot_login authenticator failed for ([116.148.186.186]) [116.148.186.186]:35396: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
country_id: 1814991
description:
Feb  7 03:19:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
country_id: 1814991
description:
Feb  7 03:19:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
country_id: 1835841
description:
2025-02-07 03:19:07 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:49864: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.205
country_id: 1668284
description:
2025-02-07 03:19:07 dovecot_plain authenticator failed for 111-70-25-205.emome-ip.hinet.net [111.70.25.205]:43845: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
country_id: 2264397
description:
2025-02-07 03:19:02 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:38798: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
country_id: 1269750
description:
Feb  7 03:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
country_id: 2264397
description:
Feb  7 03:19:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Feb  7 03:18:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
country_id: 6252001
description:
Feb  7 03:18:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
country_id: 3017382
description:
Feb  7 03:19:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
country_id: 2921044
description:
Feb  7 03:19:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-07 03:19:03 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:56139: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-07 03:19:08 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:59806: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
country_id: 1814991
description:
Feb  7 03:18:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
country_id: 2264397
description:
Feb  7 03:19:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
country_id: 1835841
description:
Feb  7 03:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.245.120
country_id: 1814991
description:
Feb  7 03:19:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.245.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
country_id: 1512440
description:
Feb  7 03:18:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-02-07 03:19:13 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:59630: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
country_id: 1835841
description:
Feb  7 03:19:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
country_id: 3469034
description:
Feb  7 03:19:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.17.125.28
country_id: 1814991
description:
2025-02-07 03:19:18 dovecot_plain authenticator failed for ([120.55.170.138]) [183.17.125.28]:6162: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/engine1/js/engine1/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
country_id: 1835841
description:
2025-02-07 03:19:25 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:35044: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
country_id: 6252001
description:
2025-02-07 03:19:30 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:65501: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
country_id: 6252001
description:
Feb  7 03:19:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.223
country_id: 6252001
description:
Feb  7 03:19:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
country_id: 1562822
description:
2025-02-07 03:19:22 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:54930: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
country_id: 1814991
description:
Feb  7 03:19:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
country_id: 1835841
description:
Feb  7 03:19:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
country_id: 6252001
description:
Feb  7 03:19:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
country_id: 1835841
description:
Feb  7 03:19:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
country_id: 1831722
description:
Feb  7 03:19:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
country_id: 3469034
description:
Feb  7 03:19:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
country_id: 1814991
description:
Feb  7 03:19:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.223
country_id: 6252001
description:
2025-02-07 03:19:15 dovecot_plain authenticator failed for ([104.241.231.223]) [104.241.231.223]:35808: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-02-07 03:19:25 dovecot_plain authenticator failed for ([221.209.48.203]) [221.209.48.203]:35442: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


