# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.51.122
country_id: 3469034
description:
[2025-02-06 06:49:24 +0100] info [webmaild] 170.238.51.122 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  6 06:49:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-06 06:49:26 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:35874: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 06:48:50 ait sshd[1021426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.232.19.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-02-06 06:49:13 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:35986: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2025-02-06 06:49:15 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:14003: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
country_id: 3469034
description:
Feb  6 06:49:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.114.106.74
country_id: 3996063
description:
[2025-02-06 06:49:21 +0100] info [webmaild] 201.114.106.74 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.234.118
country_id: 3469034
description:
[2025-02-06 06:48:46 +0100] info [webmaild] 191.5.234.118 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 06:48:51 ait sshd[1021428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
Feb  6 06:49:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
country_id: 3175395
description:
2025-02-06 06:50:04 dovecot_plain authenticator failed for ([2.194.38.121]) [2.194.38.121]:53360: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.90.252
country_id: 1880251
description:
Feb  6 06:50:18 ait sshd[1021967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.90.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.53
country_id: 2635167
description:
Feb  6 06:50:14 ait sshd[1021962]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.210.114.90
country_id: 3017382
description:
Feb  6 06:50:24 ait sshd[1021974]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.210.114.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
country_id: 3469034
description:
Feb  6 06:49:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
country_id: 298795
description:
Feb  6 06:49:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.194.38.121
country_id: 3175395
description:
Feb  6 06:50:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.194.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.53
country_id: 2635167
description:
Feb  6 06:50:14 ait sshd[1021962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.53


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
country_id: 1814991
description:
Feb  6 06:50:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.90.252
country_id: 1880251
description:
Feb  6 06:50:18 ait sshd[1021967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.90.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2025-02-06 06:50:20 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:57073: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.47.8
country_id: 1880251
description:
Feb  6 06:50:25 ait sshd[1021977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.223.47.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
country_id: 298795
description:
2025-02-06 06:49:54 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:11612: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.106.124.152
country_id: 783754
description:
[2025-02-06 06:49:55 +0100] info [webmaild] 79.106.124.152 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-06 06:50:00 dovecot_login authenticator failed for (177.43.106.73.static.host.gvt.net.br) [177.43.106.73]:58735: 535 Incorrect authentication data (set_id=mail@ait-open.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.223.47.8
country_id: 1880251
description:
Feb  6 06:50:25 ait sshd[1021977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.47.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.65.24
country_id: 2413451
description:
Feb  6 06:50:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.65.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
country_id: 2413451
description:
2025-02-06 06:50:16 dovecot_login authenticator failed for ([102.221.65.24]) [102.221.65.24]:53760: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.210.114.90
country_id: 3017382
description:
Feb  6 06:50:24 ait sshd[1021974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.114.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 06:49:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.138.18
country_id: 3469034
description:
2025-02-06 06:49:53 dovecot_plain authenticator failed for ([189.44.138.18]) [189.44.138.18]:45516: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  6 06:49:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.7.153
country_id: 1835841
description:
2025-02-06 06:51:01 dovecot_login authenticator failed for ([119.207.7.153]) [119.207.7.153]:43618: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.183.86.2
country_id: 1814991
description:
Feb  6 06:51:34 ait sshd[1022273]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.183.86.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.183.86.2
country_id: 1814991
description:
Feb  6 06:51:34 ait sshd[1022273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.86.2  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.17.125.28
country_id: 1814991
description:
2025-02-06 06:50:50 dovecot_login authenticator failed for ([120.55.170.138]) [183.17.125.28]:6482: 535 Incorrect authentication data (set_id=mail@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.7.153
country_id: 1835841
description:
Feb  6 06:50:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.7.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.210.114.90
country_id: 3017382
description:
Feb  6 06:51:01 ait sshd[1022089]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.210.114.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.210.114.90
country_id: 3017382
description:
Feb  6 06:51:01 ait sshd[1022089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.114.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.66.75
country_id: 3469034
description:
[2025-02-06 06:51:11 +0100] info [webmaild] 179.108.66.75 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.17.125.28
country_id: 1814991
description:
Feb  6 06:50:48 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.17.125.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-02-06 06:52:05 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:43466: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Feb  6 06:52:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
country_id: 1814991
description:
Feb  6 06:52:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
country_id: 6252001
description:
2025-02-06 06:52:27 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:34196: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
country_id: 1814991
description:
Feb  6 06:52:29 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2025-02-06 06:52:33 dovecot_plain authenticator failed for ([220.178.39.106]) [220.178.39.106]:56860: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
country_id: 1814991
description:
Feb  6 06:52:37 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.90.141.147
country_id: 1814991
description:
Feb  6 06:52:08 ait sshd[1022446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.90.141.147  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-06 06:52:08 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:2946: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
country_id: 6252001
description:
Feb  6 06:52:25 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
country_id: 1814991
description:
2025-02-06 06:52:25 dovecot_plain authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:45833: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
country_id: 3469034
description:
Feb  6 06:52:28 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
country_id: 1814991
description:
2025-02-06 06:52:31 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:48170: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-02-06 06:52:38 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:55618: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
country_id: 1835841
description:
Feb  6 06:52:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  6 06:52:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.113
country_id: 1814991
description:
Feb  6 06:52:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
country_id: 1814991
description:
Feb  6 06:52:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.143.81
country_id: 1820814
description:
[2025-02-06 06:51:46 +0100] info [webmaild] 119.160.143.81 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.182.158.226
country_id: 3017382
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-52.217.182.158.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-06 06:52:29 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:47964: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-02-06 06:52:33 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:33530: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.210.114.90
country_id: 3017382
description:
Feb  6 06:51:40 ait sshd[1022295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.114.90  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.148.216.233
country_id: 1210997
description:
[2025-02-06 06:52:22 +0100] info [webmaild] 103.148.216.233 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
country_id: 1814991
description:
2025-02-06 06:52:27 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:33084: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
country_id: 3469034
description:
2025-02-06 06:52:30 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:32895: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.210.114.90
country_id: 3017382
description:
Feb  6 06:51:40 ait sshd[1022295]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.210.114.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.79.186.161
country_id: 1512440
description:
[2025-02-06 06:51:50 +0100] info [webmaild] 202.79.186.161 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.90.141.147
country_id: 1814991
description:
Feb  6 06:52:08 ait sshd[1022446]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.90.141.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  6 06:52:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Feb  6 06:52:36 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
country_id: 1269750
description:
Feb  6 06:52:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
country_id: 2017370
description:
Feb  6 06:52:44 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
country_id: 1562822
description:
2025-02-06 06:52:47 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:52714: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
country_id: 1814991
description:
2025-02-06 06:52:39 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:33733: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
country_id: 1814991
description:
Feb  6 06:52:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-02-06 06:52:45 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:41336: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 06:52:47 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:52696: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.236.162.125
country_id: 2077456
description:
Feb  6 06:53:04 ait sshd[1022854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.236.162.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
country_id: 2077456
description:
Feb  6 06:53:04 ait sshd[1022854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.93.191.180
country_id: 6252001
description:
Feb  6 06:53:09 ait sshd[1022863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.191.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  6 06:53:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
country_id: 6252001
description:
Feb  6 06:53:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
country_id: 1814991
description:
Feb  6 06:52:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
country_id: 2017370
description:
2025-02-06 06:52:46 dovecot_plain authenticator failed for (l5-130-173-74.novotelecom.ru) [5.130.173.74]:41672: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
country_id: 1605651
description:
2025-02-06 06:52:46 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:61568: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
country_id: 1562822
description:
Feb  6 06:52:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.191.180
country_id: 6252001
description:
Feb  6 06:53:09 ait sshd[1022863]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.93.191.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 06:52:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
country_id: 1605651
description:
Feb  6 06:52:44 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 06:52:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 06:52:48 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:46306: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
country_id: 1814991
description:
2025-02-06 06:52:59 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:47694: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-06 06:53:15 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:36210: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.170.52
country_id: 953987
description:
[2025-02-06 06:53:35 +0100] info [webmaild] 102.219.170.52 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
country_id: 1814991
description:
2025-02-06 06:52:41 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:48109: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
country_id: 6252001
description:
2025-02-06 06:53:25 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:59084: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-06 06:54:09 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:34372: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
country_id: 1522867
description:
2025-02-06 06:54:16 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:53020: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.203.158
country_id: 1835841
description:
Feb  6 06:53:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.203.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 06:54:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
country_id: 1835841
description:
2025-02-06 06:54:02 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:46205: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
country_id: 1880251
description:
Feb  6 06:54:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
country_id: 3469034
description:
2025-02-06 06:54:16 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:33154: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
country_id: 2661886
description:
2025-02-06 06:53:52 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:48382: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-02-06 06:53:53 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:33454: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-06 06:53:54 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:25299: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 06:54:04 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:34694: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
country_id: 1814991
description:
2025-02-06 06:54:11 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:44182: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  6 06:53:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  6 06:53:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
country_id: 1835841
description:
2025-02-06 06:54:15 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:58174: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
country_id: 1814991
description:
Feb  6 06:54:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.240.104
country_id: 1880251
description:
2025-02-06 06:54:19 dovecot_plain authenticator failed for (104.240.199.112.unknown.m1.com.sg) [112.199.240.104]:60312: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.26.29.114
country_id: 2921044
description:
Feb  6 06:53:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.26.29.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
country_id: 3469034
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:53752: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-02-06 06:54:11 dovecot_plain authenticator failed for ([130.185.96.113]) [130.185.96.113]:33908: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
country_id: 1835841
description:
Feb  6 06:54:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2025-02-06 06:54:19 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:49918: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Feb  6 06:54:33 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.70.203.114
country_id: 3175395
description:
2025-02-06 06:53:52 dovecot_plain authenticator failed for ([109.70.203.114]) [109.70.203.114]:51030: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
country_id: 1880251
description:
2025-02-06 06:54:05 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:56349: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
country_id: 1835841
description:
Feb  6 06:54:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
country_id: 1835841
description:
2025-02-06 06:54:11 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:39950: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-02-06 06:54:13 dovecot_plain authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:53551: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
country_id: 6252001
description:
Feb  6 06:54:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-02-06 06:54:15 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:49536: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.209.48
country_id: 3469034
description:
Feb  6 06:54:34 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.209.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.141.105.6
country_id: 1814991
description:
2025-02-06 06:53:55 dovecot_plain authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:58364: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
country_id: 2077456
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:43528: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.140.176.170
country_id: 1814991
description:
2025-02-06 06:53:57 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:52903: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
country_id: 1835841
description:
2025-02-06 06:53:58 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:55546: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
country_id: 1814991
description:
2025-02-06 06:54:10 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:38952: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
country_id: 895949
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:35794: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Feb  6 06:53:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
country_id: 1814991
description:
Feb  6 06:54:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
country_id: 1269750
description:
2025-02-06 06:53:55 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:33744: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
country_id: 798544
description:
Feb  6 06:54:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
country_id: 798544
description:
2025-02-06 06:54:12 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:36976: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-02-06 06:54:13 dovecot_plain authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:59951: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
country_id: 1814991
description:
2025-02-06 06:54:20 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:56048: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  6 06:53:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-02-06 06:53:55 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:48666: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-02-06 06:54:00 dovecot_plain authenticator failed for ([38.148.95.217]) [38.148.95.217]:33970: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.91.96.58
country_id: 1814991
description:
Feb  6 06:54:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.91.96.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.22.86
country_id: 1835841
description:
2025-02-06 06:54:25 dovecot_plain authenticator failed for ([221.163.22.86]) [221.163.22.86]:58741: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.63.187
country_id: 1835841
description:
2025-02-06 06:53:58 dovecot_plain authenticator failed for ([121.66.63.187]) [121.66.63.187]:58547: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  6 06:53:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 06:54:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
country_id: 1819730
description:
Feb  6 06:54:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
country_id: 1835841
description:
Feb  6 06:54:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-06 06:53:54 dovecot_plain authenticator failed for ([110.38.70.172]) [110.38.70.172]:5274: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
country_id: 1835841
description:
Feb  6 06:54:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-06 06:53:59 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:33970: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
country_id: 1880251
description:
Feb  6 06:54:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
country_id: 2661886
description:
Feb  6 06:53:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.103.42
country_id: 1814991
description:
2025-02-06 06:54:15 dovecot_plain authenticator failed for ([183.24.103.42]) [183.24.103.42]:43710: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-02-06 06:54:15 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:56156: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  6 06:54:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.26.29.114
country_id: 2921044
description:
2025-02-06 06:53:52 dovecot_plain authenticator failed for ipb21a1d72.dynamic.kabel-deutschland.de [178.26.29.114]:60435: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-06 06:53:55 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:33948: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
country_id: 1835841
description:
2025-02-06 06:54:20 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:47109: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.22.55
country_id: 3469034
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.22.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
country_id: 3469034
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
country_id: 6252001
description:
Feb  6 06:54:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
country_id: 2017370
description:
2025-02-06 06:54:08 dovecot_plain authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru [87.240.58.132]:42772: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
country_id: 3469034
description:
Feb  6 06:54:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-02-06 06:54:10 dovecot_plain authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:57018: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
country_id: 6252001
description:
2025-02-06 06:54:23 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:64420: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  6 06:54:35 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.230.142
country_id: 1814991
description:
Feb  6 06:53:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.230.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-02-06 06:53:55 dovecot_plain authenticator failed for (lizomel) [65.20.148.194]:51550: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:60390: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
country_id: 1861060
description:
Feb  6 06:54:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.113
country_id: 294640
description:
Feb  6 06:54:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.32.104
country_id: 1269750
description:
Feb  6 06:54:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.32.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.91.96.58
country_id: 1814991
description:
2025-02-06 06:54:11 dovecot_plain authenticator failed for ([222.91.96.58]) [222.91.96.58]:50990: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
country_id: 1814991
description:
Feb  6 06:54:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
country_id: 3469034
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:37144: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.86.58.117
country_id: 1814991
description:
Feb  6 06:53:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.86.58.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
country_id: 1880251
description:
Feb  6 06:54:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.170.35.50
country_id: 6252001
description:
2025-02-06 06:54:06 dovecot_plain authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:53836: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.3.140.29
country_id: 1814991
description:
Feb  6 06:54:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.3.140.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
country_id: 298795
description:
2025-02-06 06:54:23 dovecot_plain authenticator failed for ([85.105.241.188]) [85.105.241.188]:36460: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
country_id: 1562822
description:
2025-02-06 06:54:28 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:60724: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.239
country_id: 1668284
description:
Feb  6 06:54:31 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.42.104.163
country_id: 1527747
description:
Feb  6 06:53:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.42.104.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
country_id: 1814991
description:
2025-02-06 06:54:02 dovecot_plain authenticator failed for ([218.92.230.86]) [218.92.230.86]:58567: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 06:54:02 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-06 06:54:16 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:55626: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
country_id: 2510769
description:
2025-02-06 06:54:18 dovecot_plain authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:39861: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.239
country_id: 1668284
description:
2025-02-06 06:54:33 dovecot_plain authenticator failed for 111-70-23-239.emome-ip.hinet.net [111.70.23.239]:53272: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
country_id: 1814991
description:
Feb  6 06:53:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-02-06 06:53:58 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:55344: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
country_id: 1814991
description:
Feb  6 06:54:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
country_id: 1522867
description:
Feb  6 06:54:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
country_id: 1880251
description:
Feb  6 06:54:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
country_id: 1814991
description:
2025-02-06 06:54:28 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:40633: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.42.104.163
country_id: 1527747
description:
2025-02-06 06:53:54 dovecot_plain authenticator failed for (212-42-104-163.static.elcat.kg) [212.42.104.163]:51814: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
country_id: 1562822
description:
Feb  6 06:54:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-02-06 06:54:07 dovecot_plain authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:43626: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
country_id: 1880251
description:
2025-02-06 06:54:07 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:37353: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
country_id: 1880251
description:
2025-02-06 06:54:22 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:46661: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  6 06:54:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.70.203.114
country_id: 3175395
description:
Feb  6 06:53:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.70.203.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
country_id: 1522867
description:
Feb  6 06:53:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-06 06:54:01 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:52615: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.247
country_id: 1269750
description:
Feb  6 06:54:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.227.30.210
country_id: 1814991
description:
Feb  6 06:54:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.227.30.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.170.35.50
country_id: 6252001
description:
Feb  6 06:54:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.170.35.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-02-06 06:54:09 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:56516: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
country_id: 1880251
description:
2025-02-06 06:54:10 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:48062: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
country_id: 3469034
description:
Feb  6 06:53:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.118.53
country_id: 3865483
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.118.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-02-06 06:53:54 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:49202: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
country_id: 2077456
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:27920: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
country_id: 2510769
description:
Feb  6 06:54:16 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
country_id: 1835841
description:
Feb  6 06:54:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
country_id: 1835841
description:
Feb  6 06:53:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  6 06:54:07 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.14.93
country_id: 3469034
description:
[2025-02-06 06:54:10 +0100] info [webmaild] 167.250.14.93 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.103.42
country_id: 1814991
description:
Feb  6 06:54:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.103.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-06 06:54:16 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:46653: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  6 06:53:57 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.203.158
country_id: 1835841
description:
2025-02-06 06:53:59 dovecot_plain authenticator failed for ([211.46.203.158]) [211.46.203.158]:48855: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
country_id: 2017370
description:
Feb  6 06:54:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
country_id: 1814991
description:
Feb  6 06:53:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
country_id: 3469034
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-02-06 06:53:54 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:51294: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
country_id: 1814991
description:
2025-02-06 06:53:55 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:49366: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.63.187
country_id: 1835841
description:
Feb  6 06:53:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.63.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.136
country_id: 1819730
description:
Feb  6 06:54:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
country_id: 1835841
description:
2025-02-06 06:54:12 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:37766: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  6 06:54:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
country_id: 1835841
description:
Feb  6 06:54:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-02-06 06:54:35 dovecot_plain authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:47379: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  6 06:54:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-06 06:54:19 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:39854: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
country_id: 6252001
description:
Feb  6 06:54:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
country_id: 1269750
description:
Feb  6 06:53:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.194
country_id: 99237
description:
Feb  6 06:53:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.230.142
country_id: 1814991
description:
2025-02-06 06:53:58 dovecot_plain authenticator failed for ([60.191.230.142]) [60.191.230.142]:53882: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
country_id: 1814991
description:
Feb  6 06:54:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
country_id: 1562822
description:
2025-02-06 06:54:07 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:40976: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 06:54:14 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:38894: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.128.156.102
country_id: 285570
description:
[2025-02-06 06:54:15 +0100] info [webmaild] 94.128.156.102 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
country_id: 6251999
description:
Feb  6 06:53:52 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
country_id: 2017370
description:
Feb  6 06:54:01 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.3.140.29
country_id: 1814991
description:
2025-02-06 06:54:11 dovecot_plain authenticator failed for ([106.3.140.29]) [106.3.140.29]:40240: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.22.86
country_id: 1835841
description:
Feb  6 06:54:23 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.22.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
country_id: 1814991
description:
2025-02-06 06:54:34 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:32801: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
country_id: 298795
description:
Feb  6 06:54:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
country_id: 1819730
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.140.176.170
country_id: 1814991
description:
Feb  6 06:53:55 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.140.176.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
country_id: 3469034
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:65029: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
country_id: 2017370
description:
2025-02-06 06:54:03 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:52680: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.227.30.210
country_id: 1814991
description:
2025-02-06 06:54:10 dovecot_plain authenticator failed for ([112.227.30.210]) [112.227.30.210]:49858: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 06:54:03 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:39612: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
country_id: 6252001
description:
2025-02-06 06:54:09 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:54188: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.240.104
country_id: 1880251
description:
Feb  6 06:54:17 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.240.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
country_id: 1880251
description:
2025-02-06 06:54:17 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:36873: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
country_id: 1562822
description:
Feb  6 06:54:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-02-06 06:53:56 dovecot_plain authenticator failed for ([167.250.118.53]) [167.250.118.53]:37932: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.230.86
country_id: 1814991
description:
Feb  6 06:54:00 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.230.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
country_id: 1819730
description:
2025-02-06 06:54:10 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:53302: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-06 06:54:14 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:20551: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-06 06:54:22 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:35081: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-02-06 06:54:36 dovecot_plain authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:60622: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  6 06:53:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.95.217
country_id: 6252001
description:
Feb  6 06:53:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.95.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-06 06:54:00 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:46440: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 06:54:06 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:45504: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
country_id: 1835841
description:
Feb  6 06:54:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.141.105.6
country_id: 1814991
description:
Feb  6 06:53:53 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.141.105.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
country_id: 895949
description:
Feb  6 06:53:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.86.58.117
country_id: 1814991
description:
2025-02-06 06:53:59 dovecot_plain authenticator failed for ([222.86.58.117]) [222.86.58.117]:54243: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Feb  6 06:54:08 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
country_id: 1814991
description:
Feb  6 06:54:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.175.140.153
country_id: 617790
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-53.178.175.140.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
country_id: 2510769
description:
Feb  6 06:54:12 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
country_id: 1819730
description:
2025-02-06 06:55:00 dovecot_plain authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:43062: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
country_id: 1835841
description:
2025-02-06 06:54:41 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:46993: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  6 06:55:33 ait sshd[1023821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.48.102
country_id: 3469034
description:
[2025-02-06 06:54:46 +0100] info [webmaild] 138.59.48.102 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  6 06:54:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 06:54:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-06 06:54:41 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:50853: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
country_id: 1819730
description:
Feb  6 06:54:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
country_id: 1835841
description:
Feb  6 06:55:09 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
country_id: 1835841
description:
Feb  6 06:54:39 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  6 06:55:33 ait sshd[1023821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
country_id: 1835841
description:
2025-02-06 06:55:11 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:43636: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.235
country_id: 99237
description:
Feb  6 06:55:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.235
country_id: 99237
description:
2025-02-06 06:55:40 dovecot_plain authenticator failed for (clackerest) [65.20.168.235]:57220: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 06:56:12 ait sshd[1023918]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.91.178.116
country_id: 2921044
description:
2025-02-06 06:55:46 dovecot_plain authenticator failed for pd95bb274.dip0.t-ipconnect.de (clackerest) [217.91.178.116]:34651: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
country_id: 2635167
description:
2025-02-06 06:55:49 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (hitubism) [81.143.51.58]:51121: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 06:56:03 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.91.178.116
country_id: 2921044
description:
Feb  6 06:55:44 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.91.178.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 06:55:54 ait sshd[1023881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.27.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 06:55:54 ait sshd[1023881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.27.5


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 06:56:12 ait sshd[1023918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
country_id: 2635167
description:
Feb  6 06:55:47 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.44.137.149
country_id: 3469034
description:
[2025-02-06 06:56:03 +0100] info [webmaild] 177.44.137.149 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.251.213.171
country_id: 1527747
description:
[2025-02-06 06:56:53 +0100] info [webmaild] 46.251.213.171 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  6 06:57:06 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 06:57:25 ait sshd[1024475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.119.166
country_id: 3469034
description:
[2025-02-06 06:57:25 +0100] info [webmaild] 45.188.119.166 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
country_id: 1814991
description:
2025-02-06 06:57:28 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:51414: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.156.177.3
country_id: 3439705
description:
[2025-02-06 06:56:40 +0100] info [webmaild] 152.156.177.3 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 06:57:25 ait sshd[1024475]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 06:57:26 ait sshd[1024479]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
country_id: 1269750
description:
2025-02-06 06:57:29 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:41165: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-06 06:56:58 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:54472: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
country_id: 1814991
description:
Feb  6 06:57:26 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Feb  6 06:56:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-06 06:57:08 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:55466: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 06:57:26 ait sshd[1024479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
country_id: 1269750
description:
Feb  6 06:57:27 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
country_id: 1835841
description:
2025-02-06 06:58:01 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:45860: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-02-06 06:57:45 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:48761: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
country_id: 1835841
description:
2025-02-06 06:57:51 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:33888: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-02-06 06:57:52 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:36388: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
country_id: 294640
description:
Feb  6 06:57:38 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
country_id: 2750405
description:
Feb  6 06:57:50 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
country_id: 1562822
description:
2025-02-06 06:58:13 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:11662: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.49.3.38
country_id: 3686110
description:
Feb  6 06:58:13 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.49.3.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
country_id: 6252001
description:
Feb  6 06:57:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 06:57:52 ait sshd[1024705]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 06:57:52 ait sshd[1024705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
country_id: 1562822
description:
Feb  6 06:58:11 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
country_id: 1814991
description:
Feb  6 06:58:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
country_id: 1819730
description:
Feb  6 06:58:24 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
country_id: 1814991
description:
2025-02-06 06:58:17 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:52484: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-02-06 06:58:26 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:53362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
country_id: 1835841
description:
Feb  6 06:57:49 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.177.96.5
country_id: 1814991
description:
2025-02-06 06:58:01 dovecot_plain authenticator failed for ([117.177.96.5]) [117.177.96.5]:32796: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.211.130.219
country_id: 1512440
description:
Feb  6 06:58:10 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.211.130.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
country_id: 1835841
description:
Feb  6 06:57:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.211.130.219
country_id: 1512440
description:
2025-02-06 06:58:12 dovecot_plain authenticator failed for ([185.211.130.219]) [185.211.130.219]:36799: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-02-06 06:57:40 dovecot_plain authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:57655: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
country_id: 3469034
description:
Feb  6 06:57:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
country_id: 6252001
description:
2025-02-06 06:57:47 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:52048: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.177.96.5
country_id: 1814991
description:
Feb  6 06:57:59 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.177.96.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.49.3.38
country_id: 3686110
description:
2025-02-06 06:58:15 dovecot_plain authenticator failed for ([181.49.3.38]) [181.49.3.38]:58077: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 204.10.194.175
country_id: 2921044
domain: iric.us
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:ARGS:fw||MV:fwrite||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/iric.us/wp-content/plugins/wp-ver.php


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
country_id: 2017370
description:
Feb  6 06:59:05 ait sshd[1025020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-02-06 06:59:17 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (whine) [69.123.219.82]:51259: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.113.146.0
country_id: 2017370
description:
[2025-02-06 06:58:44 +0100] info [webmaild] 89.113.146.0 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 06:58:59 ait sshd[1024974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.216.57.112
country_id: 1210997
description:
[2025-02-06 06:59:38 +0100] info [webmaild] 103.216.57.112 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 06:58:59 ait sshd[1024974]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.12.123.233
country_id: 1168579
description:
[2025-02-06 06:59:21 +0100] info [webmaild] 103.12.123.233 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
country_id: 6252001
description:
Feb  6 06:59:15 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
country_id: 2017370
description:
Feb  6 06:59:05 ait sshd[1025020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.156.203
country_id: 1814991
description:
Feb  6 06:59:43 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.156.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.113.61.126
country_id: 298795
description:
Feb  6 06:59:45 ait sshd[1025242]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.113.61.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.34.17.130
country_id: 1814991
description:
Feb  6 07:00:04 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.34.17.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
country_id: 690791
description:
Feb  6 06:59:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
country_id: 1835841
description:
2025-02-06 06:59:44 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:57968: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-02-06 07:00:00 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:52756: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
country_id: 690791
description:
Feb  6 07:00:21 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
country_id: 1835841
description:
Feb  6 06:59:42 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
country_id: 690791
description:
2025-02-06 06:59:44 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:43974: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.156.203
country_id: 1814991
description:
2025-02-06 06:59:45 dovecot_login authenticator failed for ([120.197.156.203]) [120.197.156.203]:37356: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
country_id: 1880251
description:
2025-02-06 06:59:47 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:45345: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.174.209.160
country_id: 1814991
description:
Feb  6 06:59:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.174.209.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.229
country_id: 1814991
description:
2025-02-06 07:00:10 dovecot_plain authenticator failed for ([112.31.93.229]) [112.31.93.229]:53176: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-06 07:00:16 dovecot_login authenticator failed for ([180.166.162.78]) [180.166.162.78]:9897: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
country_id: 690791
description:
2025-02-06 07:00:23 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (chibilum) [176.37.212.85]:51302: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
country_id: 3469034
description:
2025-02-06 07:00:34 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:37602: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
country_id: 1835841
description:
Feb  6 07:00:37 ait sshd[1025744]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
country_id: 1835841
description:
Feb  6 07:00:37 ait sshd[1025744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
country_id: 1835841
description:
2025-02-06 07:00:21 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:38022: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.113.61.126
country_id: 298795
description:
Feb  6 06:59:45 ait sshd[1025242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.113.61.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
country_id: 2510769
description:
Feb  6 06:59:56 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-02-06 06:59:58 dovecot_plain authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:51534: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-06 07:00:07 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:52545: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
country_id: 1814991
description:
Feb  6 07:00:14 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
country_id: 2077456
description:
Feb  6 07:00:18 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
country_id: 1814991
description:
Feb  6 07:00:20 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.31.12.187
country_id: 1562822
description:
Feb  6 07:00:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.31.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.31.12.187
country_id: 1562822
description:
2025-02-06 07:00:34 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:44316: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.146
country_id: 1814991
description:
Feb  6 06:59:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.174.209.160
country_id: 1814991
description:
2025-02-06 07:00:00 dovecot_plain authenticator failed for ([220.174.209.156]) [220.174.209.160]:43715: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
country_id: 1814991
description:
2025-02-06 07:00:06 dovecot_login authenticator failed for ([59.34.17.130]) [59.34.17.130]:58069: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-02-06 06:59:42 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:48992: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
country_id: 1880251
description:
Feb  6 06:59:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.164.255.188
country_id: 1210997
description:
[2025-02-06 07:00:09 +0100] info [webmaild] 103.164.255.188 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
country_id: 1814991
description:
2025-02-06 07:00:22 dovecot_plain authenticator failed for ([221.234.48.147]) [221.234.48.147]:47689: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
country_id: 6252001
description:
Feb  6 06:59:40 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
country_id: 630336
description:
Feb  6 06:59:51 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
country_id: 630336
description:
2025-02-06 06:59:53 dovecot_login authenticator failed for ([93.125.83.110]) [91.149.142.21]:57087: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  6 06:59:58 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
country_id: 1814991
description:
Feb  6 07:00:05 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
country_id: 1835841
description:
Feb  6 07:00:19 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
country_id: 2077456
description:
2025-02-06 07:00:20 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:48394: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
country_id: 1814991
description:
2025-02-06 06:59:42 dovecot_plain authenticator failed for ([222.170.255.146]) [222.170.255.146]:34440: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
country_id: 3469034
description:
Feb  6 07:00:32 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
country_id: 1814991
description:
Feb  6 07:00:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
country_id: 1814991
description:
2025-02-06 07:00:47 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:45840: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
country_id: 1819730
description:
Feb  6 07:00:46 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-06 07:00:47 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:63437: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 07:01:09 ait sshd[1026010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  6 07:00:45 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 07:00:54 ait sshd[1025850]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.183.209.179 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 07:00:54 ait sshd[1025850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.183.209.179  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-01.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
country_id: 1819730
description:
2025-02-06 07:00:48 dovecot_login authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:30281: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
country_id: 3469034
description:
2025-02-06 07:00:56 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:48130: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 07:01:09 ait sshd[1026010]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.153.47.52
country_id: 2017370
description:
[2025-02-06 07:01:20 +0100] info [webmaild] 185.153.47.52 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
country_id: 3469034
description:
Feb  6 07:00:54 ait auth[987024]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.219.132
country_id: 3469034
description:
[2025-02-06 07:02:12 +0100] info [webmaild] 131.0.219.132 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 07:02:34 ait sshd[1026748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.88.29  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 07:02:34 ait sshd[1026748]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.88.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.84.115
country_id: 3469034
description:
[2025-02-06 07:01:56 +0100] info [webmaild] 177.67.84.115 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 07:01:57 ait sshd[1026254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 07:01:57 ait sshd[1026254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 07:03:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.110.130.251
country_id: 3469034
description:
[2025-02-06 07:02:41 +0100] info [webmaild] 179.110.130.251 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
country_id: 1814991
description:
2025-02-06 07:03:39 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:50082: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
country_id: 1814991
description:
2025-02-06 07:03:52 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:62738: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.115.122.16
country_id: 2017370
description:
[2025-02-06 07:03:50 +0100] info [webmaild] 176.115.122.16 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 07:04:11 ait sshd[1027356]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
country_id: 1835841
description:
Feb  6 07:04:28 ait sshd[1027527]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 07:03:43 ait sshd[1027290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 07:04:15 ait sshd[1027369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.232.132.101
country_id: 3469034
description:
[2025-02-06 07:04:25 +0100] info [webmaild] 179.232.132.101 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
country_id: 1814991
description:
Feb  6 07:03:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 07:03:43 ait sshd[1027290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 07:04:15 ait sshd[1027369]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
country_id: 1835841
description:
Feb  6 07:04:28 ait sshd[1027527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.102
country_id: 1814991
description:
Feb  6 07:03:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 07:04:11 ait sshd[1027356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.166.86
country_id: 3469034
description:
[2025-02-06 07:05:13 +0100] info [webmaild] 170.231.166.86 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 07:05:26 ait sshd[1027968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 07:05:26 ait sshd[1027968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.250.24
country_id: 3469034
description:
[2025-02-06 07:04:43 +0100] info [webmaild] 179.127.250.24 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 07:04:55 ait sshd[1027675]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 07:04:55 ait sshd[1027675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.130.217
country_id: 3469034
description:
[2025-02-06 07:06:17 +0100] info [webmaild] 168.196.130.217 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-06 07:06:21 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:37216: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.132.194.6
country_id: 630336
description:
Feb  6 07:06:24 ait sshd[1028235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.132.194.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.39.230.40
country_id: 1835841
description:
Feb  6 07:05:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.39.230.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
country_id: 1835841
description:
2025-02-06 07:06:00 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:1866: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 07:06:09 ait sshd[1028169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.132.194.6
country_id: 630336
description:
Feb  6 07:06:24 ait sshd[1028235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.132.194.6


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 07:06:09 ait sshd[1028169]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  6 07:06:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 07:06:41 ait sshd[1028404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.111.120.245
country_id: 1210997
description:
[2025-02-06 07:06:59 +0100] info [webmaild] 103.111.120.245 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
country_id: 1835841
description:
2025-02-06 07:07:02 dovecot_plain authenticator failed for ([221.146.186.122]) [221.146.186.122]:40292: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.120.152.129
country_id: 2287781
description:
[2025-02-06 07:07:14 +0100] info [webmaild] 160.120.152.129 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 07:06:41 ait sshd[1028404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
country_id: 1835841
description:
Feb  6 07:07:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
country_id: 3865483
description:
Feb  6 07:07:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-06 07:07:12 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:33176: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 07:08:20 ait sshd[1029031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.84.38.246
country_id: 3469034
description:
2025-02-06 07:08:25 dovecot_login authenticator failed for 206.84.38.246.assistemas.net.br [206.84.38.246]:13747: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.20
country_id: 1269750
description:
2025-02-06 07:08:21 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:44291: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-06 07:08:33 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:33472: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.44.234.4
country_id: 3469034
description:
[2025-02-06 07:07:46 +0100] info [webmaild] 187.44.234.4 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  6 07:08:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 07:08:20 ait sshd[1029031]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  6 07:08:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.20
country_id: 1269750
description:
Feb  6 07:08:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.84.38.246
country_id: 3469034
description:
Feb  6 07:08:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.84.38.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  6 07:08:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.114.72
country_id: 1210997
description:
2025-02-06 07:07:52 dovecot_plain authenticator failed for ([182.160.114.72]) [182.160.114.72]:54508: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.160.114.72
country_id: 1210997
description:
Feb  6 07:07:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.160.114.72 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
country_id: 1835841
description:
Feb  6 07:07:51 ait sshd[1028961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-06 07:08:02 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:11278: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.92
country_id: 6252001
description:
Feb  6 07:08:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
country_id: 1835841
description:
Feb  6 07:07:51 ait sshd[1028961]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-06 07:08:28 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:59974: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.240.104
country_id: 1880251
description:
2025-02-06 07:09:10 dovecot_plain authenticator failed for (104.240.199.112.unknown.m1.com.sg) [112.199.240.104]:57219: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
country_id: 1880251
description:
2025-02-06 07:09:13 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [101.100.184.80]:37766: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
country_id: 1835841
description:
Feb  6 07:09:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-02-06 07:09:36 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:60846: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 07:08:42 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:60155: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.84
country_id: 1819730
description:
Feb  6 07:09:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-02-06 07:09:27 dovecot_plain authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:44860: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.130
country_id: 1668284
description:
2025-02-06 07:09:30 dovecot_plain authenticator failed for 111-70-29-130.emome-ip.hinet.net [111.70.29.130]:38296: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
country_id: 1668284
description:
2025-02-06 07:09:32 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:58442: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2025-02-06 07:09:36 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:55900: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
country_id: 337996
description:
Feb  6 07:09:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
country_id: 1814991
description:
2025-02-06 07:09:14 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:39786: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
country_id: 1814991
description:
2025-02-06 07:09:24 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:64445: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
country_id: 6252001
description:
Feb  6 07:09:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
country_id: 337996
description:
2025-02-06 07:09:28 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:60012: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.65.24
country_id: 2413451
description:
Feb  6 07:09:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.65.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-02-06 07:09:11 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:14644: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
country_id: 2017370
description:
2025-02-06 07:09:10 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:42594: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
country_id: 1814991
description:
Feb  6 07:09:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
country_id: 1814991
description:
2025-02-06 07:09:16 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:45401: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  6 07:09:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.91.176.138
country_id: 1269750
description:
Feb  6 07:09:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.91.176.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
country_id: 1835841
description:
Feb  6 07:08:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.90.150.51
country_id: 2921044
description:
Feb  6 07:09:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.90.150.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  6 07:09:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-06 07:09:19 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:34901: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
country_id: 1269750
description:
Feb  6 07:09:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
country_id: 2017370
description:
Feb  6 07:09:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.92
country_id: 6252001
description:
2025-02-06 07:08:38 dovecot_login authenticator failed for ([104.241.229.92]) [104.241.229.92]:49487: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.147.136.221
country_id: 3175395
description:
Feb  6 07:09:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.147.136.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.195.7
country_id: 1814991
description:
Feb  6 07:09:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.195.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.89.159.59
country_id: 3865483
description:
Feb  6 07:09:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.89.159.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.130
country_id: 1668284
description:
Feb  6 07:09:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.147.136.221
country_id: 3175395
description:
2025-02-06 07:09:30 dovecot_plain authenticator failed for net-93-147-136-221.cust.vodafonedsl.it [93.147.136.221]:58486: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
country_id: 2017370
description:
Feb  6 07:09:08 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.240.104
country_id: 1880251
description:
Feb  6 07:09:08 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.240.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.195.7
country_id: 1814991
description:
2025-02-06 07:09:14 dovecot_plain authenticator failed for ([125.69.195.7]) [125.69.195.7]:36870: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2025-02-06 07:09:26 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:35968: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
country_id: 1814991
description:
Feb  6 07:09:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  6 07:08:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.119.194
country_id: 1814991
description:
Feb  6 07:09:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-02-06 07:09:11 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34120: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-06 07:09:15 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:50626: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-06 07:09:22 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:58807: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
country_id: 1668284
description:
Feb  6 07:09:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
country_id: 1835841
description:
2025-02-06 07:09:35 dovecot_plain authenticator failed for ([183.98.215.147]) [183.98.215.147]:6327: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.123.41.225
country_id: 3437598
description:
[2025-02-06 07:09:07 +0100] info [webmaild] 181.123.41.225 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.138
country_id: 1269750
description:
2025-02-06 07:09:11 dovecot_plain authenticator failed for ([118.91.176.138]) [118.91.176.138]:45238: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
country_id: 1835841
description:
2025-02-06 07:09:28 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:33640: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
country_id: 1814991
description:
Feb  6 07:09:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
country_id: 1835841
description:
2025-02-06 07:09:22 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:40613: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
country_id: 1880251
description:
Feb  6 07:09:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
country_id: 1814991
description:
Feb  6 07:09:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
country_id: 3469034
description:
2025-02-06 07:09:15 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:58893: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
country_id: 1814991
description:
Feb  6 07:09:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.179.12.25
country_id: 1835841
description:
2025-02-06 07:08:42 dovecot_plain authenticator failed for ([210.179.12.25]) [210.179.12.25]:58051: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
country_id: 3469034
description:
Feb  6 07:09:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
country_id: 1819730
description:
Feb  6 07:09:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-02-06 07:09:23 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:37686: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-02-06 07:09:23 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:60250: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
country_id: 1835841
description:
Feb  6 07:09:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
country_id: 6252001
description:
2025-02-06 07:09:29 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:36168: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.179.12.25
country_id: 1835841
description:
Feb  6 07:08:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.179.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.7.135.13
country_id: 1814991
description:
Feb  6 07:09:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.7.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
country_id: 2413451
description:
2025-02-06 07:09:07 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:36736: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
country_id: 3469034
description:
Feb  6 07:09:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.7.135.13
country_id: 1814991
description:
2025-02-06 07:09:12 dovecot_plain authenticator failed for ([119.7.135.13]) [119.7.135.13]:48318: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.119.194
country_id: 1814991
description:
2025-02-06 07:09:13 dovecot_plain authenticator failed for ([113.57.119.194]) [113.57.119.194]:55964: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
country_id: 2661886
description:
Feb  6 07:09:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
country_id: 2017370
description:
2025-02-06 07:09:27 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:49884: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
country_id: 1880251
description:
Feb  6 07:09:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
country_id: 1835841
description:
2025-02-06 07:08:59 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:27095: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Feb  6 07:09:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
country_id: 6252001
description:
Feb  6 07:09:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
country_id: 6252001
description:
2025-02-06 07:09:25 dovecot_plain authenticator failed for ([8.20.22.58]) [8.20.22.58]:54015: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.90.150.51
country_id: 2921044
description:
2025-02-06 07:09:08 dovecot_plain authenticator failed for ip-109-090-150-051.um36.pools.vodafone-ip.de [109.90.150.51]:40010: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
country_id: 1835841
description:
Feb  6 07:09:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.43.110
country_id: 1880251
description:
47.128.43.110 - - [06/Feb/2025:07:09:25 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11288232" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-06 07:09:26 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:53223: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
country_id: 2017370
description:
Feb  6 07:09:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
country_id: 1819730
description:
2025-02-06 07:09:19 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:28429: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.230.125.20
country_id: 298795
description:
[2025-02-06 07:09:46 +0100] info [webmaild] 88.230.125.20 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
country_id: 2017370
description:
Feb  6 07:10:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
country_id: 2077456
description:
Feb  6 07:09:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
country_id: 2017370
description:
2025-02-06 07:09:43 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:58126: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
country_id: 2077456
description:
2025-02-06 07:09:46 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:50454: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.177.120.165
country_id: 1814991
description:
Feb  6 07:09:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.177.120.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.58.159
country_id: 3865483
description:
Feb  6 07:09:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.58.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.177.120.165
country_id: 1814991
description:
2025-02-06 07:09:39 dovecot_plain authenticator failed for ([61.177.120.165]) [61.177.120.165]:40564: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 07:09:46 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:40867: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.159
country_id: 3865483
description:
2025-02-06 07:09:47 dovecot_plain authenticator failed for ([45.71.58.159]) [45.71.58.159]:43944: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
country_id: 1814991
description:
Feb  6 07:09:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
country_id: 1562822
description:
Feb  6 07:10:09 ait sshd[1029771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.175.253.179
country_id: 783754
description:
[2025-02-06 07:10:20 +0100] info [webmaild] 185.175.253.179 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
country_id: 1814991
description:
2025-02-06 07:09:41 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:33985: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
country_id: 1562822
description:
Feb  6 07:10:09 ait sshd[1029771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
country_id: 2017370
description:
Feb  6 07:09:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
country_id: 1814991
description:
Feb  6 07:09:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  6 07:09:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
country_id: 1814991
description:
2025-02-06 07:09:55 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:36450: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2025-02-06 07:10:03 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:45006: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.62.177.12
country_id: 1168579
description:
[2025-02-06 07:09:43 +0100] info [webmaild] 39.62.177.12 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.75
country_id: 1269750
description:
2025-02-06 07:10:57 dovecot_plain authenticator failed for (nsg-corporate-75.230.187.122.airtel.in) [122.187.230.75]:45338: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
country_id: 1668284
description:
Feb  6 07:11:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
country_id: 192950
description:
Feb  6 07:10:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  6 07:10:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.75
country_id: 1269750
description:
Feb  6 07:10:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-06 07:10:54 dovecot_login authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:42651: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.178.158
country_id: 3469034
description:
2025-02-06 07:11:28 dovecot_plain authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:59030: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
country_id: 192950
description:
2025-02-06 07:10:42 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:58308: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
country_id: 1643084
description:
2025-02-06 07:10:53 dovecot_login authenticator failed for (43-252-8-34.quantum.net.id) [43.252.8.34]:59588: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 07:10:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.182.227.240
country_id: 1835841
description:
Feb  6 07:11:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.182.227.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.182.227.240
country_id: 1835841
description:
2025-02-06 07:11:15 dovecot_login authenticator failed for ([121.182.227.240]) [121.182.227.240]:53552: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.178.158
country_id: 3469034
description:
Feb  6 07:11:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.178.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
country_id: 1643084
description:
Feb  6 07:10:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
country_id: 1668284
description:
2025-02-06 07:11:14 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:56431: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.189.28.242
country_id: 3469034
description:
[2025-02-06 07:12:17 +0100] info [webmaild] 200.189.28.242 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 07:12:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Feb  6 07:11:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2025-02-06 07:11:41 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:59878: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.117.212
country_id: 3469034
description:
[2025-02-06 07:12:07 +0100] info [webmaild] 177.73.117.212 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-06 07:12:46 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:35670: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.172.61.145
country_id: 1814991
description:
Feb  6 07:12:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.172.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
country_id: 1814991
description:
2025-02-06 07:12:57 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:58693: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 07:12:46 ait sshd[1030611]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.22.115.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 07:12:46 ait sshd[1030611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.105.75.200
country_id: 3865483
description:
[2025-02-06 07:12:46 +0100] info [webmaild] 190.105.75.200 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.174.91.85
country_id: 2017370
description:
[2025-02-06 07:12:47 +0100] info [webmaild] 85.174.91.85 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
country_id: 6252001
description:
Feb  6 07:12:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
country_id: 99237
description:
2025-02-06 07:14:16 dovecot_plain authenticator failed for (atcokles) [65.20.155.91]:53205: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.30.14.25
country_id: 3658394
description:
[2025-02-06 07:14:35 +0100] info [webmaild] 193.30.14.25 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
country_id: 99237
description:
Feb  6 07:14:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 07:14:18 ait sshd[1031092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.63.225  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 07:14:18 ait sshd[1031092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.63.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 07:15:31 ait sshd[1031601]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.193.135.200
country_id: 3469034
description:
[2025-02-06 07:15:36 +0100] info [webmaild] 186.193.135.200 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.171.25
country_id: 3469034
description:
[2025-02-06 07:14:51 +0100] info [webmaild] 177.105.171.25 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  6 07:15:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-06 07:15:34 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (aplazonfat) [80.14.31.158]:51459: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 07:15:31 ait sshd[1031601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
country_id: 1835841
description:
Feb  6 07:15:10 ait sshd[1031456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
country_id: 1835841
description:
Feb  6 07:15:10 ait sshd[1031456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.18
country_id: 1880251
description:
47.128.58.18 - - [06/Feb/2025:07:14:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21187867 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/management/page/2/?filter_course-language=95&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.200.19
country_id: 1210997
description:
[2025-02-06 07:15:09 +0100] info [webmaild] 27.147.200.19 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.57.174
country_id: 1880251
description:
47.128.57.174 - - [06/Feb/2025:07:14:42 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5004464" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.57.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
country_id: 2658434
description:
Feb  6 07:14:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
country_id: 2658434
description:
2025-02-06 07:14:49 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (horined) [109.164.246.53]:55364: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 07:15:42 ait sshd[1031752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.239.165.120


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 07:16:29 ait sshd[1031845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 07:15:39 ait sshd[1031732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 07:15:42 ait sshd[1031752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.239.165.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 07:16:29 ait sshd[1031845]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-16.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 07:15:39 ait sshd[1031732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.176.71.139
country_id: 2542007
description:
[2025-02-06 07:17:18 +0100] info [webmaild] 160.176.71.139 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.178
country_id: 1668284
description:
2025-02-06 07:17:02 dovecot_plain authenticator failed for 111-70-21-178.emome-ip.hinet.net [111.70.21.178]:43783: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  6 07:16:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 07:17:07 ait sshd[1032127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.71.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
country_id: 3017382
description:
Feb  6 07:17:07 ait sshd[1032127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-06 07:16:51 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:52040: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.178
country_id: 1668284
description:
Feb  6 07:17:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.4.126.248
country_id: 3469034
description:
[2025-02-06 07:17:07 +0100] info [webmaild] 200.4.126.248 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.190.228.152
country_id: 1210997
description:
[2025-02-06 07:17:44 +0100] info [webmaild] 103.190.228.152 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
country_id: 1814991
description:
Feb  6 07:18:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 07:18:25 dovecot_login authenticator failed for ([60.174.40.155]) [60.174.40.155]:48596: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.31
country_id: 1819730
description:
Feb  6 07:18:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
country_id: 1819730
description:
2025-02-06 07:18:37 dovecot_login authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:9467: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 07:17:45 ait sshd[1032356]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 07:17:45 ait sshd[1032356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.97.34.251
country_id: 3469034
description:
[2025-02-06 07:17:50 +0100] info [webmaild] 200.97.34.251 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.134.136
country_id: 1819730
description:
Feb  6 07:18:47 ait sshd[1032808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.134.136  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 180.94.29.1
country_id: 1210997
description:
[2025-02-06 07:19:36 +0100] info [webmaild] 180.94.29.1 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  6 07:20:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.10.31.42
country_id: 1282988
description:
[2025-02-06 07:19:56 +0100] info [webmaild] 103.10.31.42 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.156.103.75
country_id: 3439705
description:
[2025-02-06 07:20:09 +0100] info [webmaild] 152.156.103.75 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.122.11.10
country_id: 3865483
description:
[2025-02-06 07:20:27 +0100] info [webmaild] 186.122.11.10 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-06 07:20:30 dovecot_plain authenticator failed for (cousce) [77.51.214.170]:45801: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Feb  6 07:20:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.249.102
country_id: 1835841
description:
2025-02-06 07:20:58 dovecot_plain authenticator failed for ([125.143.249.102]) [125.143.249.102]:60919: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.173.106.95
country_id: 2921044
description:
Feb  6 07:21:05 ait sshd[1033617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.173.106.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.173.106.95
country_id: 2921044
description:
Feb  6 07:21:06 ait sshd[1033617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.173.106.95  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
country_id: 1814991
description:
Feb  6 07:21:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 07:20:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 07:20:40 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:56622: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
country_id: 1814991
description:
2025-02-06 07:21:19 dovecot_plain authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:44514: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-02-06 07:20:52 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:36790: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.249.102
country_id: 1835841
description:
Feb  6 07:20:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.249.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.235.159
country_id: 99237
description:
2025-02-06 07:21:45 dovecot_plain authenticator failed for (leciaze) [65.20.235.159]:42097: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.237.122.14
country_id: 99237
description:
[2025-02-06 07:22:24 +0100] info [webmaild] 212.237.122.14 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 07:21:40 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (lornbiotry) [109.67.154.24]:45144: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
country_id: 1269750
description:
Feb  6 07:22:04 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
country_id: 1269750
description:
2025-02-06 07:22:06 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:48602: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 07:22:19 ait sshd[1034135]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 07:22:19 ait sshd[1034135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  6 07:21:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.235.159
country_id: 99237
description:
Feb  6 07:21:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.235.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  6 07:21:49 ait sshd[1033889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-06 07:22:21 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:46750: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  6 07:21:49 ait sshd[1033889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
country_id: 1814991
description:
Feb  6 07:22:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  6 07:22:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
country_id: 337996
description:
Feb  6 07:21:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 07:22:25 ait sshd[1034139]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.22.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 07:22:25 ait sshd[1034139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.22.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
country_id: 337996
description:
2025-02-06 07:21:56 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:35642: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
country_id: 1814991
description:
2025-02-06 07:22:07 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:50140: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.208.42.183
country_id: 1168579
description:
[2025-02-06 07:22:14 +0100] info [webmaild] 154.208.42.183 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 07:22:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
country_id: 1835841
description:
2025-02-06 07:22:56 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:56116: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
country_id: 6252001
description:
Feb  6 07:23:25 ait sshd[1034588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
country_id: 290557
description:
Feb  6 07:22:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.137.25
country_id: 1814991
description:
2025-02-06 07:22:51 dovecot_plain authenticator failed for ([112.28.137.25]) [112.28.137.25]:49040: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
country_id: 1835841
description:
Feb  6 07:22:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  6 07:23:28 ait sshd[1034604]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.47.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.244.205
country_id: 1835841
description:
2025-02-06 07:23:30 dovecot_login authenticator failed for ([112.164.244.205]) [112.164.244.205]:47616: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 07:23:10 ait sshd[1034561]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.39.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  6 07:23:28 ait sshd[1034604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.47.166


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.12.150.140
country_id: 3658394
description:
[2025-02-06 07:22:46 +0100] info [webmaild] 190.12.150.140 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2025-02-06 07:22:53 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:56076: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.31.205
country_id: 1210997
description:
[2025-02-06 07:22:55 +0100] info [webmaild] 103.151.31.205 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
country_id: 6252001
description:
Feb  6 07:23:25 ait sshd[1034588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
country_id: 290557
description:
2025-02-06 07:22:41 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:36280: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.137.25
country_id: 1814991
description:
Feb  6 07:22:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.137.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
country_id: 1880251
description:
Feb  6 07:23:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
country_id: 1880251
description:
2025-02-06 07:23:04 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:46928: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 07:23:10 ait sshd[1034561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
country_id: 290557
description:
Feb  6 07:23:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
country_id: 1814991
description:
Feb  6 07:22:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.152
country_id: 1668284
description:
Feb  6 07:23:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.152
country_id: 1668284
description:
2025-02-06 07:23:04 dovecot_plain authenticator failed for 111-70-22-152.emome-ip.hinet.net [111.70.22.152]:41981: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.244.205
country_id: 1835841
description:
Feb  6 07:23:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.244.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
country_id: 290557
description:
2025-02-06 07:23:39 dovecot_login authenticator failed for ([94.207.226.113]) [94.207.226.113]:38413: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/configure.php.bak||User:aitext01||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 07:24:25 ait sshd[1034886]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 07:23:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 07:24:25 ait sshd[1034886]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.168
country_id: 6252001
description:
Feb  6 07:25:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.102.11.55
country_id: 3469034
description:
[2025-02-06 07:25:21 +0100] info [webmaild] 177.102.11.55 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.189
country_id: 1814991
description:
Feb  6 07:25:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.189
country_id: 1814991
description:
2025-02-06 07:25:08 dovecot_login authenticator failed for ([111.61.176.189]) [111.61.176.189]:13256: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.107.226.175
country_id: 3469034
description:
[2025-02-06 07:25:22 +0100] info [webmaild] 189.107.226.175 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.168
country_id: 6252001
description:
2025-02-06 07:25:21 dovecot_login authenticator failed for ([104.241.228.168]) [104.241.228.168]:41645: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.98.100.11
country_id: 2589581
description:
[2025-02-06 07:24:48 +0100] info [webmaild] 105.98.100.11 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 111.88.56.182
country_id: 1168579
description:
[2025-02-06 07:24:53 +0100] info [webmaild] 111.88.56.182 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.106.243
country_id: 1668284
description:
Feb  6 07:25:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.106.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.106.243
country_id: 1668284
description:
2025-02-06 07:25:47 dovecot_plain authenticator failed for 110-25-106-243.adsl.fetnet.net [110.25.106.243]:49916: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-06 07:25:47 dovecot_plain authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:38633: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
country_id: 1880251
description:
2025-02-06 07:26:25 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:43302: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.28.154.169
country_id: 6252001
description:
2025-02-06 07:25:56 dovecot_plain authenticator failed for s169-154-28-8.gec.tx.wi-power.com [8.28.154.169]:47125: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.24
country_id: 1269750
description:
Feb  6 07:26:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.24
country_id: 1269750
description:
2025-02-06 07:26:14 dovecot_login authenticator failed for (nsg-corporate-24.227.187.122.airtel.in) [122.187.227.24]:33485: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  6 07:26:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  6 07:25:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
country_id: 1814991
description:
Feb  6 07:26:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
country_id: 1814991
description:
2025-02-06 07:26:08 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:40432: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 07:26:35 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:57406: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.28.154.169
country_id: 6252001
description:
Feb  6 07:25:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.28.154.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
country_id: 1880251
description:
Feb  6 07:26:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-06 07:26:25 dovecot_login authenticator failed for ([175.136.192.106]) [175.136.192.106]:50260: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  6 07:26:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 07:26:48 ait sshd[1035735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 07:26:48 ait sshd[1035735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
country_id: 1835841
description:
Feb  6 07:27:30 ait sshd[1035939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.183.107.28
country_id: 298795
description:
[2025-02-06 07:27:27 +0100] info [webmaild] 78.183.107.28 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
country_id: 1835841
description:
Feb  6 07:27:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-06 07:27:26 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:39268: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
country_id: 1835841
description:
Feb  6 07:27:30 ait sshd[1035939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 07:27:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
country_id: 1835841
description:
2025-02-06 07:27:14 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:53732: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  6 07:27:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.12.229
country_id: 1835841
description:
2025-02-06 07:28:26 dovecot_login authenticator failed for ([221.162.12.229]) [221.162.12.229]:44183: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
country_id: 1819730
description:
2025-02-06 07:28:34 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:44371: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
country_id: 2658434
description:
Feb  6 07:27:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Feb  6 07:28:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
country_id: 1814991
description:
2025-02-06 07:28:21 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:54499: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
country_id: 3469034
description:
Feb  6 07:28:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
country_id: 1814991
description:
Feb  6 07:28:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
country_id: 1835841
description:
2025-02-06 07:28:38 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:2964: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
country_id: 3469034
description:
Feb  6 07:27:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
country_id: 3469034
description:
2025-02-06 07:27:46 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:41454: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.186.255.126
country_id: 248816
description:
[2025-02-06 07:27:57 +0100] info [webmaild] 91.186.255.126 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
country_id: 1819730
description:
Feb  6 07:28:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.226.255.240
country_id: 1835841
description:
Feb  6 07:28:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.226.255.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
country_id: 1814991
description:
2025-02-06 07:27:59 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:55441: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
country_id: 3469034
description:
2025-02-06 07:28:12 dovecot_login authenticator failed for (186-247-238-25.user.veloxzone.com.br) [200.149.51.186]:44385: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.41.23.56
country_id: 3625428
description:
[2025-02-06 07:28:29 +0100] info [webmaild] 38.41.23.56 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2025-02-06 07:28:23 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:46052: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.12.229
country_id: 1835841
description:
Feb  6 07:28:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.12.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
country_id: 1814991
description:
Feb  6 07:27:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.24.161.246
country_id: 3469034
description:
[2025-02-06 07:27:57 +0100] info [webmaild] 177.24.161.246 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
country_id: 2658434
description:
2025-02-06 07:27:58 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (nospainess) [109.164.246.53]:42362: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
country_id: 6251999
description:
Feb  6 07:29:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.162.217
country_id: 1835841
description:
Feb  6 07:29:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.162.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
country_id: 1814991
description:
Feb  6 07:29:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.29.221.242
country_id: 953987
description:
Feb  6 07:29:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.29.221.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  6 07:29:13 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.122.10
country_id: 2510769
description:
Feb  6 07:29:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.122.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.122.10
country_id: 2510769
description:
2025-02-06 07:29:33 dovecot_login authenticator failed for ([46.35.122.10]) [46.35.122.10]:56161: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-02-06 07:28:46 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:36932: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
country_id: 1819730
description:
Feb  6 07:29:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
country_id: 3277605
description:
Feb  6 07:28:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
country_id: 6251999
description:
2025-02-06 07:29:02 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:35922: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.221.242
country_id: 953987
description:
2025-02-06 07:29:05 dovecot_login authenticator failed for ([217.29.221.242]) [217.29.221.242]:49002: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-06 07:29:15 dovecot_login authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:50709: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
country_id: 1819730
description:
2025-02-06 07:29:26 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:35765: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.162.217
country_id: 1835841
description:
2025-02-06 07:29:27 dovecot_login authenticator failed for ([59.24.162.217]) [59.24.162.217]:37629: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 07:29:39 ait sshd[1036676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2025-02-06 07:29:39 dovecot_login authenticator failed for ([112.29.109.174]) [112.30.127.9]:48349: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.115.243.2
country_id: 1210997
description:
[2025-02-06 07:30:09 +0100] info [webmaild] 103.115.243.2 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Feb  6 07:29:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  6 07:29:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-06 07:29:54 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:48984: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.142.197
country_id: 1814991
description:
2025-02-06 07:30:13 dovecot_plain authenticator failed for ([120.236.142.197]) [120.236.142.197]:39155: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
country_id: 1819730
description:
2025-02-06 07:30:35 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:55850: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
country_id: 1814991
description:
2025-02-06 07:29:48 dovecot_login authenticator failed for ([222.175.110.3]) [222.175.110.3]:57360: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
country_id: 290557
description:
Feb  6 07:30:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 07:30:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.142.197
country_id: 1814991
description:
Feb  6 07:30:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.142.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
country_id: 1819730
description:
Feb  6 07:30:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 07:29:39 ait sshd[1036676]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
country_id: 1522867
description:
2025-02-06 07:29:45 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:59848: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
country_id: 1814991
description:
2025-02-06 07:30:16 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:42884: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
country_id: 1814991
description:
Feb  6 07:29:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
country_id: 290557
description:
2025-02-06 07:30:05 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:45855: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
country_id: 1522867
description:
Feb  6 07:29:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-02-06 07:29:48 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:48897: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
country_id: 1814991
description:
Feb  6 07:30:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.231.231.118
country_id: 1210997
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-30.103.231.231.118


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.31.194.203
country_id: 130758
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:07-30.194.31.194.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-02-06 07:30:40 dovecot_plain authenticator failed for (schings) [65.20.129.28]:36644: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
country_id: 1880251
description:
Feb  6 07:31:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Feb  6 07:30:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.174.202.130
country_id: 298795
description:
[2025-02-06 07:30:54 +0100] info [webmaild] 78.174.202.130 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
country_id: 1814991
description:
Feb  6 07:31:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.237.0.90
country_id: 3932488
description:
[2025-02-06 07:31:36 +0100] info [webmaild] 190.237.0.90 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
country_id: 1814991
description:
2025-02-06 07:31:19 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:57948: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 07:31:29 ait sshd[1037450]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.220.32
country_id: 3865483
description:
[2025-02-06 07:30:45 +0100] info [webmaild] 45.167.220.32 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-31.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
country_id: 1880251
description:
2025-02-06 07:31:28 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:54084: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 07:31:29 ait sshd[1037450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.48.177.46
country_id: 3469034
description:
[2025-02-06 07:32:54 +0100] info [webmaild] 189.48.177.46 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  6 07:33:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  6 07:32:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
country_id: 1835841
description:
Feb  6 07:32:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
country_id: 1819730
description:
2025-02-06 07:33:01 dovecot_plain authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:52063: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  6 07:33:18 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
country_id: 1819730
description:
Feb  6 07:32:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-06 07:33:20 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:41705: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.11.100.137
country_id: 3469034
description:
[2025-02-06 07:33:27 +0100] info [webmaild] 187.11.100.137 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
country_id: 690791
description:
Feb  6 07:33:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-06 07:32:50 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:54191: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2025-02-06 07:33:01 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:46681: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-06 07:33:11 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:53883: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
country_id: 690791
description:
2025-02-06 07:33:34 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:46817: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 07:34:05 dovecot_plain authenticator failed for ([216.194.174.74]) [216.194.174.27]:13560: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
country_id: 1835841
description:
Feb  6 07:33:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
country_id: 1835841
description:
2025-02-06 07:33:54 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:37618: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.167.225
country_id: 1835841
description:
2025-02-06 07:33:56 dovecot_plain authenticator failed for ([14.49.167.225]) [14.49.167.225]:45935: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
country_id: 1269750
description:
Feb  6 07:34:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.167.225
country_id: 1835841
description:
Feb  6 07:33:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.167.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 07:34:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.79.83.28
country_id: 6252001
description:
Feb  6 07:34:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.79.83.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-02-06 07:34:04 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:53036: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 07:34:17 ait sshd[1038490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.18.95.131
country_id: 3469034
description:
[2025-02-06 07:34:31 +0100] info [webmaild] 189.18.95.131 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.79.83.28
country_id: 6252001
description:
2025-02-06 07:34:33 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:45826: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 70.34.242.27
country_id: 798544
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:07-34.70.34.242.27


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.137.140.121
country_id: 3865483
description:
[2025-02-06 07:33:50 +0100] info [webmaild] 190.137.140.121 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 07:34:17 ait sshd[1038490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.166
country_id: 1819730
description:
2025-02-06 07:34:54 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:56809: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.62.143.61
country_id: 1168579
description:
[2025-02-06 07:35:00 +0100] info [webmaild] 39.62.143.61 - ads19a00020y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user ads19a00020y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.87.230
country_id: 1814991
description:
Feb  6 07:35:05 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.87.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.87.230
country_id: 1814991
description:
2025-02-06 07:35:07 dovecot_plain authenticator failed for ([1.31.87.230]) [1.31.87.230]:36012: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  6 07:34:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-06 07:34:47 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:53844: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-02-06 07:34:48 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:52924: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.166
country_id: 1819730
description:
Feb  6 07:34:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.10.50
country_id: 1668284
description:
2025-02-06 07:35:08 dovecot_plain authenticator failed for 111-70-10-50.emome-ip.hinet.net [111.70.10.50]:40883: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-02-06 07:35:27 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:59780: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-06 07:35:13 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:34924: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Feb  6 07:35:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  6 07:34:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-06 07:34:51 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:52319: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
country_id: 1643084
description:
Feb  6 07:34:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.10.50
country_id: 1668284
description:
Feb  6 07:35:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.10.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.151.10
country_id: 3469034
description:
[2025-02-06 07:35:36 +0100] info [webmaild] 167.250.151.10 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.204.233.3
country_id: 6252001
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:07-35.15.204.233.3


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.157.40.29
country_id: 3469034
description:
[2025-02-06 07:36:09 +0100] info [webmaild] 177.157.40.29 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.154.36.90
country_id: 3686110
description:
[2025-02-06 07:36:33 +0100] info [webmaild] 186.154.36.90 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  6 07:37:21 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.46.74
country_id: 1835841
description:
Feb  6 07:37:32 ait sshd[1039758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.236.46.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
country_id: 3469034
description:
Feb  6 07:36:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.32.104
country_id: 1269750
description:
Feb  6 07:36:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.32.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-02-06 07:36:57 dovecot_plain authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:56053: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-02-06 07:36:57 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:49298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.86.87
country_id: 6252001
description:
2025-02-06 07:37:12 dovecot_plain authenticator failed for c-73-199-86-87.hsd1.nj.comcast.net (lizeril) [73.199.86.87]:48878: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-06 07:37:23 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:32951: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.32
country_id: 1880251
description:
47.128.58.32 - - [06/Feb/2025:07:37:29 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22702419 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/mod/forum/discuss.php?d=8788" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
country_id: 99237
description:
Feb  6 07:36:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 07:37:02 ait sshd[1039665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
country_id: 2245662
description:
2025-02-06 07:37:06 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:38918: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.86.87
country_id: 6252001
description:
Feb  6 07:37:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.86.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
country_id: 6251999
description:
2025-02-06 07:37:16 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:36842: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-02-06 07:36:40 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:59666: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.171.113.13
country_id: 3624060
description:
[2025-02-06 07:37:14 +0100] info [webmaild] 190.171.113.13 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.236.46.74
country_id: 1835841
description:
Feb  6 07:37:32 ait sshd[1039758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.236.46.74  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 07:37:02 ait sshd[1039665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
country_id: 2245662
description:
Feb  6 07:37:04 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
country_id: 597427
description:
Feb  6 07:37:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
country_id: 597427
description:
2025-02-06 07:37:12 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:43384: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
country_id: 6251999
description:
Feb  6 07:37:14 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.219.128
country_id: 1562822
description:
Feb  6 07:38:22 ait sshd[1040147]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.130.219.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
country_id: 2017370
description:
Feb  6 07:37:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
country_id: 1522867
description:
Feb  6 07:37:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
country_id: 3923057
description:
2025-02-06 07:38:04 dovecot_login authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:35660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
country_id: 1269750
description:
Feb  6 07:38:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
country_id: 1269750
description:
2025-02-06 07:38:14 dovecot_login authenticator failed for (21-172-91-219.static.youbroadband.in) [219.91.172.21]:36026: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
country_id: 298795
description:
Feb  6 07:38:21 ait sshd[1040151]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  6 07:37:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
country_id: 2017370
description:
2025-02-06 07:37:50 dovecot_login authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:53167: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
country_id: 1835841
description:
Feb  6 07:38:00 ait sshd[1039839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
country_id: 298795
description:
Feb  6 07:38:21 ait sshd[1040151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
country_id: 1522867
description:
2025-02-06 07:37:59 dovecot_login authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:59576: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
country_id: 1835841
description:
Feb  6 07:38:00 ait sshd[1039839]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.218.90.3
country_id: 690791
description:
[2025-02-06 07:38:29 +0100] info [webmaild] 91.218.90.3 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
country_id: 1814991
description:
2025-02-06 07:38:14 dovecot_login authenticator failed for ([61.184.26.197]) [61.184.26.197]:45624: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.130.219.128
country_id: 1562822
description:
Feb  6 07:38:22 ait sshd[1040147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.219.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-06 07:37:43 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:55832: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
country_id: 3923057
description:
Feb  6 07:38:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
country_id: 1814991
description:
Feb  6 07:38:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.88.22
country_id: 1814991
description:
Feb  6 07:38:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.88.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.203
country_id: 6252001
description:
2025-02-06 07:39:04 dovecot_login authenticator failed for ([104.241.237.203]) [104.241.237.203]:56152: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
country_id: 690791
description:
2025-02-06 07:39:11 dovecot_plain authenticator failed for (tormotas) [109.108.95.66]:42127: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 07:39:19 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.88.22
country_id: 1814991
description:
2025-02-06 07:38:52 dovecot_login authenticator failed for ([61.150.88.22]) [61.150.88.22]:44967: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.203
country_id: 6252001
description:
Feb  6 07:39:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.162.209.87
country_id: 1210997
description:
[2025-02-06 07:39:03 +0100] info [webmaild] 103.162.209.87 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
country_id: 690791
description:
Feb  6 07:39:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.242.55.185
country_id: 614540
description:
[2025-02-06 07:39:21 +0100] info [webmaild] 77.242.55.185 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 162.215.215.200
country_id: 6252001
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:07-39.162.215.215.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-02-06 07:40:22 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:54196: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
country_id: 1835841
description:
Feb  6 07:40:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.206.91.51
country_id: 597427
description:
Feb  6 07:39:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.206.91.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
country_id: 1814991
description:
2025-02-06 07:39:44 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:46441: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.224.123.153
country_id: 6252001
description:
Feb  6 07:39:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.224.123.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  6 07:39:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.157.224.104
country_id: 1269750
description:
Feb  6 07:40:30 ait sshd[1041163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.157.224.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 07:40:22 ait sshd[1041138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.200.20.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.27.127.27
country_id: 2464461
description:
[2025-02-06 07:40:04 +0100] info [webmaild] 197.27.127.27 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.125.200
country_id: 294640
description:
Feb  6 07:40:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2025-02-06 07:40:10 dovecot_plain authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:38226: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
country_id: 1814991
description:
Feb  6 07:39:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-02-06 07:40:08 dovecot_plain authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:56169: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-02-06 07:40:08 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:50706: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.124.148
country_id: 1835841
description:
Feb  6 07:39:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.124.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
country_id: 597427
description:
2025-02-06 07:39:57 dovecot_plain authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:43638: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
country_id: 2077456
description:
Feb  6 07:40:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 07:40:22 ait sshd[1041138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.200.20.12  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-06 07:39:47 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:39464: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.123.153
country_id: 6252001
description:
2025-02-06 07:39:54 dovecot_plain authenticator failed for ([24.224.123.153]) [24.224.123.153]:35517: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.209.44.9
country_id: 2661886
description:
Feb  6 07:40:08 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.209.44.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 07:41:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.52.214
country_id: 3469034
description:
[2025-02-06 07:41:28 +0100] info [webmaild] 191.242.52.214 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.202.108
country_id: 3658394
description:
[2025-02-06 07:42:05 +0100] info [webmaild] 45.70.202.108 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 07:42:01 ait sshd[1041537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-02-06 07:42:29 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:47970: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
country_id: 6252001
description:
2025-02-06 07:42:36 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:57228: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.104.88.221
country_id: 3686110
description:
[2025-02-06 07:41:59 +0100] info [webmaild] 191.104.88.221 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  6 07:42:21 ait sshd[1041709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.84.154.106  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 07:42:01 ait sshd[1041537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  6 07:42:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  6 07:42:21 ait sshd[1041709]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.84.154.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
country_id: 337996
description:
Feb  6 07:42:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
country_id: 6252001
description:
Feb  6 07:42:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.96.184
country_id: 3469034
description:
[2025-02-06 07:42:38 +0100] info [webmaild] 138.219.96.184 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  6 07:42:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-06 07:42:48 dovecot_plain authenticator failed for ([110.38.70.172]) [110.38.70.172]:29385: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
country_id: 732800
description:
Feb  6 07:43:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
country_id: 732800
description:
2025-02-06 07:43:32 dovecot_plain authenticator failed for 95-87-225-236.ip.btc-net.bg (nonamess) [95.87.225.236]:33452: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
country_id: 3508796
description:
Feb  6 07:42:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-06 07:42:45 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:56550: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
country_id: 2542007
description:
Feb  6 07:43:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
country_id: 2542007
description:
2025-02-06 07:43:28 dovecot_plain authenticator failed for (cably) [102.53.15.54]:49546: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.231.59.92
country_id: 1562822
description:
Feb  6 07:44:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.231.59.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.245.153.246
country_id: 3469034
description:
[2025-02-06 07:44:04 +0100] info [webmaild] 179.245.153.246 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Feb  6 07:44:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.125.149.40
country_id: 6252001
description:
Feb  6 07:44:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.125.149.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.231.59.92
country_id: 1562822
description:
2025-02-06 07:44:19 dovecot_login authenticator failed for ([14.231.59.92]) [14.231.59.92]:33775: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.209
country_id: 2542007
description:
Feb  6 07:44:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.14.16.245
country_id: 3469034
description:
[2025-02-06 07:44:34 +0100] info [webmaild] 187.14.16.245 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 07:43:59 ait sshd[1042260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.19.211.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 07:43:59 ait sshd[1042260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.19.211.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Feb  6 07:44:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-02-06 07:44:31 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:39530: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.78.229.165
country_id: 953987
description:
[2025-02-06 07:44:34 +0100] info [webmaild] 41.78.229.165 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Feb  6 07:44:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.177.79.74
country_id: 2661886
description:
Feb  6 07:44:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.177.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
country_id: 1814991
description:
Feb  6 07:44:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.40.63
country_id: 2661886
description:
2025-02-06 07:45:13 dovecot_plain authenticator failed for c188-150-40-63.bredband.tele2.se (clogivent) [188.150.40.63]:48604: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.120.180
country_id: 3469034
description:
[2025-02-06 07:45:06 +0100] info [webmaild] 45.227.120.180 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-06 07:45:32 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:46470: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 07:45:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.40.63
country_id: 2661886
description:
Feb  6 07:45:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.40.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 07:45:08 ait sshd[1042796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
country_id: 617790
description:
Feb  6 07:45:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.157.224.104
country_id: 1269750
description:
Feb  6 07:45:30 ait sshd[1042931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.157.224.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 07:45:08 ait sshd[1042796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.78
country_id: 1814991
description:
2025-02-06 07:45:45 dovecot_login authenticator failed for ([111.61.176.78]) [111.61.176.78]:44516: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 07:45:46 ait sshd[1042975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.149.139 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-46.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 07:46:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
country_id: 3175395
description:
2025-02-06 07:45:41 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:52511: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-06 07:46:24 dovecot_plain authenticator failed for (acemariker) [102.53.15.56]:55450: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
country_id: 3923057
description:
2025-02-06 07:46:14 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:50472: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.160.245.126
country_id: 2635167
description:
[2025-02-06 07:45:48 +0100] info [cpaneld] 193.160.245.126 - lemsas "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
country_id: 6252001
description:
Feb  6 07:45:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
country_id: 1269750
description:
Feb  6 07:46:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
country_id: 1269750
description:
2025-02-06 07:46:22 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:34668: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.39.240
country_id: 1880251
description:
47.128.39.240 - - [06/Feb/2025:07:46:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15025238 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/spcp/index.php?Itemid=357&id=292&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.39.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.78.222
country_id: 1835841
description:
2025-02-06 07:46:32 dovecot_plain authenticator failed for ([211.57.78.222]) [211.57.78.222]:39044: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 07:45:46 ait sshd[1042975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.149.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 07:46:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Feb  6 07:46:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
country_id: 3923057
description:
Feb  6 07:46:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.87.17
country_id: 3469034
description:
[2025-02-06 07:46:30 +0100] info [webmaild] 45.163.87.17 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-02-06 07:46:33 dovecot_plain authenticator failed for ([170.233.29.157]) [170.233.29.157]:36562: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.78
country_id: 1814991
description:
Feb  6 07:45:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.157
country_id: 3865483
description:
Feb  6 07:46:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.78.222
country_id: 1835841
description:
Feb  6 07:46:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.78.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 07:45:57 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:51022: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
country_id: 3175395
description:
Feb  6 07:45:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.67.14
country_id: 6252001
description:
Feb  6 07:47:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.67.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.67.14
country_id: 6252001
description:
2025-02-06 07:47:32 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:42985: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.5.136
country_id: 3658394
description:
[2025-02-06 07:47:38 +0100] info [webmaild] 45.186.5.136 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.241.204
country_id: 3469034
description:
[2025-02-06 07:47:01 +0100] info [webmaild] 45.161.241.204 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.157.224.104
country_id: 1269750
description:
Feb  6 07:47:02 ait sshd[1043316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.157.224.104


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.224.104
country_id: 1269750
description:
Feb  6 07:47:05 ait sshd[1043316]: Failed password for invalid user nasty from 103.157.224.104 port 58856 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.221.131
country_id: 3469034
description:
[2025-02-06 07:47:05 +0100] info [webmaild] 201.71.221.131 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 07:47:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.0.127.202
country_id: 1814991
description:
2025-02-06 07:47:47 dovecot_login authenticator failed for ([111.0.127.202]) [111.0.127.202]:15629: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
country_id: 953987
description:
Feb  6 07:48:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.0.127.202
country_id: 1814991
description:
Feb  6 07:47:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.0.127.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.246.152
country_id: 1835841
description:
Feb  6 07:47:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.246.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.246.152
country_id: 1835841
description:
2025-02-06 07:47:48 dovecot_plain authenticator failed for ([125.143.246.152]) [125.143.246.152]:46412: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
country_id: 953987
description:
2025-02-06 07:48:32 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:51076: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.168.113
country_id: 1814991
description:
Feb  6 07:48:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.168.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.168.113
country_id: 1814991
description:
2025-02-06 07:48:35 dovecot_plain authenticator failed for ([219.145.168.113]) [219.145.168.113]:45186: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.252.217
country_id: 1861060
description:
Feb  6 07:48:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.252.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.252.217
country_id: 1861060
description:
2025-02-06 07:48:04 dovecot_login authenticator failed for p96217-obmd01.tokyo.ocn.ne.jp [124.101.252.217]:59940: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
country_id: 732800
description:
Feb  6 07:48:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
country_id: 6252001
description:
Feb  6 07:48:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
country_id: 732800
description:
2025-02-06 07:48:43 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:57814: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
country_id: 2635167
description:
2025-02-06 07:48:52 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:54886: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.211.5
country_id: 3469034
description:
[2025-02-06 07:49:02 +0100] info [webmaild] 143.137.211.5 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
country_id: 1835841
description:
Feb  6 07:49:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.51.157.242
country_id: 3469034
description:
[2025-02-06 07:49:31 +0100] info [webmaild] 179.51.157.242 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
country_id: 2635167
description:
Feb  6 07:48:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2025-02-06 07:49:19 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:40655: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
country_id: 1814991
description:
Feb  6 07:49:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-02-06 07:48:44 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:33961: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-06 07:50:04 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:64450: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.78.21
country_id: 1512440
description:
[2025-02-06 07:50:15 +0100] info [webmaild] 84.54.78.21 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 07:49:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.247
country_id: 6252001
description:
2025-02-06 07:49:50 dovecot_login authenticator failed for ([104.241.234.247]) [104.241.234.247]:48632: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
country_id: 6252001
description:
Feb  6 07:49:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.63.35.150
country_id: 3469034
description:
[2025-02-06 07:49:38 +0100] info [webmaild] 189.63.35.150 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  6 07:50:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.137.226
country_id: 1814991
description:
Feb  6 07:50:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.137.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.137.226
country_id: 1814991
description:
2025-02-06 07:50:36 dovecot_plain authenticator failed for ([60.171.137.226]) [60.171.137.226]:40751: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.247
country_id: 6252001
description:
Feb  6 07:49:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.200.154.39
country_id: 2921044
description:
Feb  6 07:49:38 ait sshd[1044274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.200.154.39  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
country_id: 1814991
description:
2025-02-06 07:49:39 dovecot_login authenticator failed for ([218.22.253.37]) [218.22.253.37]:35065: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
country_id: 6252001
description:
2025-02-06 07:49:54 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:55964: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.200.154.39
country_id: 2921044
description:
Feb  6 07:49:38 ait sshd[1044274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.200.154.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-02-06 07:50:46 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:58704: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 07:51:01 ait sshd[1044787]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.0.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.122
country_id: 1880251
description:
47.128.58.122 - - [06/Feb/2025:07:51:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19555764 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/a2011e/search/results?ip=40.77.167.48&limit=10&method=GET" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.122


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.26
country_id: 1814991
description:
Feb  6 07:51:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.26
country_id: 1814991
description:
2025-02-06 07:51:26 dovecot_plain authenticator failed for ([42.180.162.26]) [42.180.162.26]:46915: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
country_id: 6252001
description:
Feb  6 07:51:33 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.53.228.227
country_id: 1527747
description:
[2025-02-06 07:51:35 +0100] info [webmaild] 185.53.228.227 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
country_id: 6252001
description:
2025-02-06 07:51:35 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:50199: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Feb  6 07:50:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 07:51:01 ait sshd[1044787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.0.30  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 07:51:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
country_id: 1835841
description:
Feb  6 07:51:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.144.1.116
country_id: 953987
description:
[2025-02-06 07:52:07 +0100] info [webmaild] 41.144.1.116 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
country_id: 1668284
description:
Feb  6 07:52:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  6 07:51:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
country_id: 1814991
description:
Feb  6 07:51:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
country_id: 1835841
description:
2025-02-06 07:51:51 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:54327: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 07:52:06 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2025-02-06 07:52:07 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:34316: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 116.90.103.131
country_id: 1168579
description:
[2025-02-06 07:52:08 +0100] info [webmaild] 116.90.103.131 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-06 07:51:48 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:54091: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
country_id: 1814991
description:
2025-02-06 07:51:50 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:47288: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
country_id: 1668284
description:
2025-02-06 07:52:34 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:55058: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
country_id: 2921044
description:
Feb  6 07:52:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-06 07:52:41 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:49799: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.56.90.205
country_id: 2635167
description:
Feb  6 07:52:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.56.90.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.90.205
country_id: 2635167
description:
2025-02-06 07:52:47 dovecot_plain authenticator failed for ([212.56.90.205]) [212.56.90.205]:38348: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
country_id: 1814991
description:
Feb  6 07:53:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-02-06 07:53:27 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:54508: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
country_id: 953987
description:
Feb  6 07:53:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.83.83.12
country_id: 3469034
description:
[2025-02-06 07:52:40 +0100] info [webmaild] 189.83.83.12 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.144.187.114
country_id: 130758
description:
2025-02-06 07:53:24 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:53612: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Feb  6 07:53:25 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
country_id: 3469034
description:
Feb  6 07:53:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
country_id: 1269750
description:
Feb  6 07:52:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.144.187.114
country_id: 130758
description:
Feb  6 07:53:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.144.187.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
country_id: 1814991
description:
2025-02-06 07:53:28 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:33861: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-02-06 07:52:59 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:58436: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
country_id: 3469034
description:
2025-02-06 07:53:38 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:59961: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
country_id: 3469034
description:
Feb  6 07:54:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-02-06 07:54:29 dovecot_plain authenticator failed for ([196.28.226.125]) [196.28.226.125]:59827: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
country_id: 1814991
description:
2025-02-06 07:54:30 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:41811: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.193.151.10
country_id: 1819730
description:
Feb  6 07:54:05 ait sshd[1045791]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.193.151.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.193.151.10
country_id: 1819730
description:
Feb  6 07:54:05 ait sshd[1045791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.193.151.10  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
country_id: 1814991
description:
Feb  6 07:54:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
country_id: 2017370
description:
Feb  6 07:54:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
country_id: 6252001
description:
2025-02-06 07:53:55 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:41692: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.215.61.211
country_id: 690791
description:
[2025-02-06 07:54:03 +0100] info [webmaild] 91.215.61.211 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Feb  6 07:54:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
country_id: 2017370
description:
2025-02-06 07:54:32 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:59528: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
country_id: 1269750
description:
Feb  6 07:54:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.239.252.94
country_id: 1819730
description:
2025-02-06 07:54:29 dovecot_plain authenticator failed for 061239252094.static.ctinets.com [61.239.252.94]:48116: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
country_id: 1814991
description:
2025-02-06 07:54:29 dovecot_plain authenticator failed for ([39.88.252.16]) [39.88.252.16]:53610: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
country_id: 6252001
description:
2025-02-06 07:54:34 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:50475: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
country_id: 1814991
description:
2025-02-06 07:54:38 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:49320: 535 Incorrect authentication data


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 07:53:55 ait sshd[1045793]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
country_id: 6252001
description:
2025-02-06 07:54:29 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:36148: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
country_id: 6252001
description:
Feb  6 07:54:32 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
country_id: 1835841
description:
Feb  6 07:54:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 07:54:33 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:47731: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
country_id: 2017370
description:
2025-02-06 07:54:26 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:41549: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.239.252.94
country_id: 1819730
description:
Feb  6 07:54:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.239.252.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
country_id: 1835841
description:
Feb  6 07:54:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
country_id: 2077456
description:
Feb  6 07:54:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.232.31
country_id: 1814991
description:
2025-02-06 07:54:30 dovecot_plain authenticator failed for ([183.245.232.31]) [183.245.232.31]:51064: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
country_id: 1814991
description:
2025-02-06 07:54:31 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:38223: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
country_id: 953987
description:
2025-02-06 07:53:39 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:42716: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
country_id: 2017370
description:
Feb  6 07:54:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 07:54:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2025-02-06 07:54:25 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:41012: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
country_id: 798544
description:
Feb  6 07:54:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
country_id: 1835841
description:
2025-02-06 07:54:28 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:44200: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-02-06 07:54:32 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:52691: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-06 07:53:53 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:50739: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
country_id: 130758
description:
Feb  6 07:53:55 ait sshd[1045793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
country_id: 1835841
description:
2025-02-06 07:54:30 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:41704: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.190
country_id: 1269750
description:
2025-02-06 07:54:30 dovecot_plain authenticator failed for ([122.187.229.190]) [122.187.229.190]:55938: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
country_id: 6252001
description:
Feb  6 07:53:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
country_id: 1814991
description:
Feb  6 07:54:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.190
country_id: 1269750
description:
Feb  6 07:54:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
country_id: 1269750
description:
Feb  6 07:54:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-06 07:54:11 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:64056: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
country_id: 6252001
description:
Feb  6 07:54:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
country_id: 3469034
description:
2025-02-06 07:54:30 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:52586: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-02-06 07:54:25 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:36027: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
country_id: 6252001
description:
Feb  6 07:54:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
country_id: 798544
description:
2025-02-06 07:54:30 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:37806: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-02-06 07:54:29 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:42502: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
country_id: 1814991
description:
2025-02-06 07:54:32 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:60495: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
country_id: 2017370
description:
2025-02-06 07:54:36 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:54070: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
country_id: 1814991
description:
Feb  6 07:54:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.232.31
country_id: 1814991
description:
Feb  6 07:54:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.232.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
country_id: 1814991
description:
Feb  6 07:54:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
country_id: 2017370
description:
Feb  6 07:54:30 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
country_id: 6252001
description:
2025-02-06 07:54:29 dovecot_plain authenticator failed for ([38.187.146.68]) [38.187.146.68]:45138: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
country_id: 1814991
description:
Feb  6 07:53:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
country_id: 2510769
description:
Feb  6 07:54:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
country_id: 2017370
description:
Feb  6 07:54:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.125
country_id: 1036973
description:
Feb  6 07:54:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
country_id: 1269750
description:
2025-02-06 07:54:28 dovecot_plain authenticator failed for ([103.170.225.80]) [103.170.225.80]:41474: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-02-06 07:55:12 dovecot_plain authenticator failed for ([113.193.187.154]) [113.193.187.154]:45214: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
country_id: 6252001
description:
Feb  6 07:54:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-06 07:54:46 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:44641: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
country_id: 1819730
description:
2025-02-06 07:54:56 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:56704: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.110
country_id: 1814991
description:
2025-02-06 07:54:52 dovecot_plain authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:40489: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
country_id: 1814991
description:
Feb  6 07:55:04 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
country_id: 1814991
description:
2025-02-06 07:54:40 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:37287: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-02-06 07:54:46 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:36378: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
country_id: 1668284
description:
2025-02-06 07:54:48 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:55675: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
country_id: 1814991
description:
Feb  6 07:54:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-06 07:54:43 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:40429: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.42.19
country_id: 3175395
description:
Feb  6 07:54:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.4.42.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-02-06 07:55:04 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:32632: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.174.136
country_id: 1814991
description:
Feb  6 07:54:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.174.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
country_id: 1814991
description:
Feb  6 07:54:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  6 07:54:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
country_id: 1814991
description:
2025-02-06 07:54:43 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:56098: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
country_id: 1835841
description:
2025-02-06 07:54:48 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:51086: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
country_id: 1835841
description:
2025-02-06 07:54:58 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:53166: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.207.2
country_id: 3437598
description:
[2025-02-06 07:54:44 +0100] info [webmaild] 45.177.207.2 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.8.245
country_id: 6252001
description:
2025-02-06 07:54:45 dovecot_plain authenticator failed for ([65.76.8.245]) [65.76.8.245]:46432: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.3.140.28
country_id: 1814991
description:
Feb  6 07:54:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.3.140.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
country_id: 453733
description:
2025-02-06 07:54:48 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:38238: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
country_id: 1835841
description:
2025-02-06 07:54:57 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:47804: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
country_id: 337996
description:
Feb  6 07:55:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-06 07:55:14 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:34026: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  6 07:54:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
country_id: 1835841
description:
2025-02-06 07:54:42 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:40651: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
country_id: 1814991
description:
2025-02-06 07:54:46 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:52008: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.189.155.2
country_id: 3996063
description:
[2025-02-06 07:55:18 +0100] info [webmaild] 187.189.155.2 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
country_id: 453733
description:
Feb  6 07:54:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
country_id: 1814991
description:
Feb  6 07:54:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.167.225
country_id: 1835841
description:
2025-02-06 07:54:52 dovecot_plain authenticator failed for ([14.49.167.225]) [14.49.167.225]:40895: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
country_id: 1835841
description:
Feb  6 07:54:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 07:54:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
country_id: 1814991
description:
Feb  6 07:54:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
country_id: 1814991
description:
Feb  6 07:54:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.163.162
country_id: 3469034
description:
[2025-02-06 07:54:44 +0100] info [webmaild] 45.233.163.162 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
country_id: 1814991
description:
2025-02-06 07:55:06 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:45701: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-06 07:54:50 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:33862: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
country_id: 1861060
description:
Feb  6 07:54:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  6 07:54:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.3.140.28
country_id: 1814991
description:
2025-02-06 07:54:49 dovecot_plain authenticator failed for ([106.3.140.28]) [106.3.140.28]:42562: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
country_id: 1814991
description:
2025-02-06 07:54:49 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:34468: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  6 07:54:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  6 07:54:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
country_id: 1814991
description:
2025-02-06 07:54:44 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:57008: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
country_id: 1668284
description:
Feb  6 07:54:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.110
country_id: 1814991
description:
Feb  6 07:54:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.8.245
country_id: 6252001
description:
Feb  6 07:54:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.8.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 07:54:45 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:48974: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
country_id: 1269750
description:
2025-02-06 07:54:45 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:33714: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.187.154
country_id: 1269750
description:
Feb  6 07:55:10 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.187.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 07:55:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
country_id: 1269750
description:
Feb  6 07:54:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  6 07:54:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.167.225
country_id: 1835841
description:
Feb  6 07:54:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.167.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-02-06 07:54:55 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:36660: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
country_id: 617790
description:
2025-02-06 07:54:40 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:44282: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
country_id: 1835841
description:
Feb  6 07:54:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-06 07:54:47 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:39476: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
country_id: 617790
description:
Feb  6 07:54:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.101.77
country_id: 1814991
description:
2025-02-06 07:54:41 dovecot_plain authenticator failed for ([112.26.101.77]) [112.26.101.77]:46951: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.221
country_id: 1814991
description:
Feb  6 07:54:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.4.42.19
country_id: 3175395
description:
2025-02-06 07:54:50 dovecot_plain authenticator failed for (host-194-4-42-19.net.intranetwifi.it) [194.4.42.19]:57346: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
country_id: 1835841
description:
Feb  6 07:54:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
country_id: 1835841
description:
Feb  6 07:54:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
country_id: 1819730
description:
Feb  6 07:54:54 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.221
country_id: 1814991
description:
2025-02-06 07:54:58 dovecot_plain authenticator failed for ([113.64.208.221]) [113.64.208.221]:47155: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  6 07:55:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
country_id: 1814991
description:
Feb  6 07:54:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-02-06 07:54:40 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:44399: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
country_id: 1814991
description:
2025-02-06 07:54:46 dovecot_plain authenticator failed for ([117.159.174.136]) [117.159.174.136]:46026: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-06 07:55:48 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:40802: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
country_id: 1835841
description:
Feb  6 07:56:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
country_id: 1835841
description:
2025-02-06 07:56:29 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:56617: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
country_id: 2542007
description:
Feb  6 07:56:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
country_id: 3469034
description:
Feb  6 07:56:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-06 07:56:09 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:42035: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
country_id: 1668284
description:
2025-02-06 07:55:49 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:38663: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
country_id: 1835841
description:
2025-02-06 07:55:57 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:58124: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
country_id: 1562822
description:
2025-02-06 07:56:00 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:22053: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
country_id: 1819730
description:
2025-02-06 07:56:02 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:38258: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 07:56:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
country_id: 1814991
description:
Feb  6 07:56:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
country_id: 1814991
description:
2025-02-06 07:56:36 dovecot_login authenticator failed for ([183.247.194.8]) [183.247.194.8]:60053: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
country_id: 1668284
description:
Feb  6 07:55:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
country_id: 1835841
description:
Feb  6 07:55:55 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
country_id: 1562822
description:
Feb  6 07:55:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.202.43.57
country_id: 289688
description:
[2025-02-06 07:56:33 +0100] info [webmaild] 176.202.43.57 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-02-06 07:56:38 dovecot_plain authenticator failed for (unwarking) [154.144.243.93]:44114: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Feb  6 07:55:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
country_id: 1819730
description:
Feb  6 07:56:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 07:56:20 ait sshd[1046643]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.241.179.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 07:56:20 ait sshd[1046643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.241.179.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-06 07:57:00 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:55170: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
country_id: 1814991
description:
Feb  6 07:57:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
country_id: 1814991
description:
2025-02-06 07:57:04 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:37108: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.217.11
country_id: 3658394
description:
[2025-02-06 07:57:07 +0100] info [webmaild] 177.234.217.11 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
country_id: 1668284
description:
Feb  6 07:57:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
country_id: 1835841
description:
Feb  6 07:56:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-06 07:56:48 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:46272: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 07:57:15 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
country_id: 6251999
description:
2025-02-06 07:56:58 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:45007: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
country_id: 1668284
description:
2025-02-06 07:57:14 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:36958: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  6 07:56:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  6 07:56:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
country_id: 6251999
description:
Feb  6 07:56:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
country_id: 3469034
description:
2025-02-06 07:57:13 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:54762: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
country_id: 1835841
description:
2025-02-06 07:56:41 dovecot_plain authenticator failed for ([183.123.27.87]) [183.123.27.87]:48363: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
country_id: 3469034
description:
Feb  6 07:57:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-06 07:57:51 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:18247: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2025-02-06 07:58:19 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:57540: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
country_id: 2661886
description:
2025-02-06 07:58:26 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:51818: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
country_id: 2017370
description:
2025-02-06 07:58:33 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:54854: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 07:58:12 ait sshd[1047046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
country_id: 2661886
description:
Feb  6 07:58:24 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
country_id: 1880251
description:
2025-02-06 07:58:11 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:48327: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
country_id: 1835841
description:
Feb  6 07:58:17 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
country_id: 2017370
description:
Feb  6 07:58:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 07:58:12 ait sshd[1047046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.81.78
country_id: 3469034
description:
[2025-02-06 07:57:42 +0100] info [webmaild] 45.167.81.78 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  6 07:57:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.64.8.23
country_id: 587116
description:
[2025-02-06 07:58:06 +0100] info [webmaild] 188.64.8.23 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
country_id: 1880251
description:
Feb  6 07:58:09 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.246.12
country_id: 1835841
description:
2025-02-06 07:58:43 dovecot_plain authenticator failed for ([125.143.246.12]) [125.143.246.12]:39664: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 07:58:46 ait sshd[1047367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.218.215.240  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
country_id: 2017370
description:
2025-02-06 07:58:44 dovecot_plain authenticator failed for (90.188.40.123.stbur.ru) [90.188.40.123]:44250: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.209.18
country_id: 1880251
description:
Feb  6 07:59:02 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.209.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  6 07:59:20 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.246.12
country_id: 1835841
description:
Feb  6 07:58:41 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.246.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
country_id: 2017370
description:
Feb  6 07:58:42 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-06 07:59:01 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:55752: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.226.108
country_id: 1861060
description:
2025-02-06 07:59:10 dovecot_plain authenticator failed for p39108-obmd01.osaka.ocn.ne.jp [153.141.226.108]:38284: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
country_id: 1668284
description:
Feb  6 07:59:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.122.104
country_id: 1512440
description:
[2025-02-06 07:59:15 +0100] info [webmaild] 84.54.122.104 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
country_id: 1668284
description:
2025-02-06 07:59:18 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:35443: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 07:58:46 ait sshd[1047367]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.218.215.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-06 07:59:22 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:39247: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  6 07:58:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.209.18
country_id: 1880251
description:
2025-02-06 07:59:04 dovecot_plain authenticator failed for bb121-7-209-18.singnet.com.sg [121.7.209.18]:43862: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Feb  6 08:00:31 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-06 08:00:33 dovecot_plain authenticator failed for (auresseud) [102.53.15.56]:57277: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.205.167.131
country_id: 290557
description:
[2025-02-06 07:59:51 +0100] info [webmaild] 94.205.167.131 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.240.129.68
country_id: 1814991
description:
Feb  6 08:00:08 ait sshd[1048004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.240.129.68  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
country_id: 1835841
description:
Feb  6 08:00:16 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
country_id: 1835841
description:
2025-02-06 08:00:18 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:58060: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.240.129.68
country_id: 1814991
description:
Feb  6 08:00:08 ait sshd[1048004]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.240.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  6 08:00:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.69.46.148
country_id: 1168579
description:
2025-02-06 08:00:07 dovecot_plain authenticator failed for ([202.69.46.148]) [202.69.46.148]:47341: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.52.64.211
country_id: 2542007
description:
[2025-02-06 08:00:12 +0100] info [webmaild] 102.52.64.211 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 08:00:30 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (sinavacrut) [109.67.154.24]:49770: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
country_id: 2017370
description:
2025-02-06 08:01:38 dovecot_login authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:49258: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 08:00:56 ait sshd[1048214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.240.73.64  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.44.57.219
country_id: 3469034
description:
[2025-02-06 08:00:55 +0100] info [webmaild] 191.44.57.219 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
country_id: 2017370
description:
Feb  6 08:01:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-00.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 08:00:56 ait sshd[1048214]: pam_imunify(sshd:auth): [IM360_RBL] The IP 4.240.73.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.163.103
country_id: 99237
description:
Feb  6 08:02:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.163.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.196.149.216
country_id: 298795
description:
[2025-02-06 08:02:07 +0100] info [webmaild] 46.196.149.216 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
country_id: 2264397
description:
Feb  6 08:02:34 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
country_id: 1814991
description:
2025-02-06 08:02:24 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:18414: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
country_id: 2264397
description:
2025-02-06 08:02:36 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:35259: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.124.42
country_id: 1835841
description:
Feb  6 08:01:48 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.124.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 08:01:52 ait sshd[1048438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.194.54  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 08:02:12 ait sshd[1048488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
country_id: 1814991
description:
Feb  6 08:02:22 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 08:02:28 ait sshd[1048651]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.124.42
country_id: 1835841
description:
2025-02-06 08:01:50 dovecot_login authenticator failed for ([121.189.124.42]) [121.189.124.42]:35035: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 08:01:52 ait sshd[1048438]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.68.194.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-02-06 08:02:09 dovecot_plain authenticator failed for (susabilike) [65.20.163.103]:45225: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 08:02:12 ait sshd[1048488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 08:02:28 ait sshd[1048651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  6 08:02:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
country_id: 174982
description:
Feb  6 08:03:23 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
country_id: 1269750
description:
Feb  6 08:03:36 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
country_id: 1814991
description:
Feb  6 08:03:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
country_id: 174982
description:
2025-02-06 08:03:25 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:43768: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.142.218
country_id: 3469034
description:
[2025-02-06 08:02:40 +0100] info [webmaild] 45.173.142.218 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  6 08:02:48 ait sshd[1048685]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-06 08:02:48 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:38682: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
country_id: 6252001
description:
2025-02-06 08:03:03 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:41608: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
country_id: 6252001
description:
Feb  6 08:03:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 08:03:29 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
country_id: 617790
description:
Feb  6 08:03:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.126.43.207
country_id: 3469034
description:
[2025-02-06 08:03:37 +0100] info [webmaild] 189.126.43.207 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  6 08:02:48 ait sshd[1048685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
country_id: 6252001
description:
Feb  6 08:03:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.26.62
country_id: 3469034
description:
[2025-02-06 08:03:04 +0100] info [webmaild] 45.166.26.62 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
country_id: 1814991
description:
2025-02-06 08:03:13 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:19713: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.178.142
country_id: 3469034
description:
Feb  6 08:03:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.178.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
country_id: 1269750
description:
2025-02-06 08:03:39 dovecot_plain authenticator failed for ([116.66.190.67]) [116.66.190.67]:37526: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
country_id: 1814991
description:
2025-02-06 08:03:41 dovecot_plain authenticator failed for ([60.174.35.18]) [60.174.35.18]:41007: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
country_id: 1814991
description:
2025-02-06 08:03:42 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:56686: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 08:03:44 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.212.189.104
country_id: 1269750
description:
2025-02-06 08:04:01 dovecot_plain authenticator failed for ([103.250.160.76]) [117.212.189.104]:52563: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.35.18
country_id: 1814991
description:
Feb  6 08:03:39 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.35.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
country_id: 2017370
description:
Feb  6 08:03:43 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
country_id: 1880251
description:
Feb  6 08:03:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.117.195
country_id: 1814991
description:
2025-02-06 08:03:47 dovecot_plain authenticator failed for ([112.91.117.195]) [112.91.117.195]:46692: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-02-06 08:03:49 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:36440: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.178.142
country_id: 3469034
description:
2025-02-06 08:03:41 dovecot_plain authenticator failed for (187-93-245-254.customer.tdatabrasil.net.br) [187.50.178.142]:45570: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
country_id: 2510769
description:
Feb  6 08:03:49 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
country_id: 1814991
description:
2025-02-06 08:04:02 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:43172: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-02-06 08:04:03 dovecot_plain authenticator failed for (cathone) [65.20.149.93]:52628: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
country_id: 6252001
description:
2025-02-06 08:03:37 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:56482: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
country_id: 1819730
description:
Feb  6 08:03:47 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
country_id: 2661886
description:
2025-02-06 08:03:55 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:34648: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-06 08:04:14 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:37344: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  6 08:04:12 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
country_id: 1269750
description:
Feb  6 08:04:27 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
country_id: 1269750
description:
2025-02-06 08:04:29 dovecot_login authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:36912: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
country_id: 1814991
description:
Feb  6 08:03:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-06 08:04:13 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:58535: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
country_id: 2510769
description:
2025-02-06 08:03:51 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:55705: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.91.142
country_id: 6252001
description:
Feb  6 08:03:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.91.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-06 08:03:55 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:20385: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
country_id: 6252001
description:
2025-02-06 08:03:47 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:51138: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.91.142
country_id: 6252001
description:
2025-02-06 08:03:54 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:53219: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-02-06 08:03:54 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:44146: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.127.188
country_id: 1835841
description:
2025-02-06 08:04:00 dovecot_plain authenticator failed for ([114.108.127.188]) [114.108.127.188]:51466: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
country_id: 1814991
description:
2025-02-06 08:04:09 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:45831: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
country_id: 6252001
description:
Feb  6 08:03:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
country_id: 3469034
description:
Feb  6 08:03:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
country_id: 1269750
description:
2025-02-06 08:03:38 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:59200: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
country_id: 1831722
description:
Feb  6 08:03:51 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
country_id: 1814991
description:
Feb  6 08:03:57 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.66.190.67
country_id: 1269750
description:
Feb  6 08:03:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.66.190.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
country_id: 1835841
description:
Feb  6 08:03:52 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-06 08:03:53 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:27452: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.127.188
country_id: 1835841
description:
Feb  6 08:03:58 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.127.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
country_id: 617790
description:
2025-02-06 08:03:37 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:45900: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.138.18
country_id: 3469034
description:
2025-02-06 08:03:40 dovecot_plain authenticator failed for ([189.44.138.18]) [189.44.138.18]:48209: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2025-02-06 08:03:45 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:53592: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
country_id: 1880251
description:
2025-02-06 08:03:51 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:43945: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
country_id: 1819730
description:
Feb  6 08:03:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.212.189.104
country_id: 1269750
description:
Feb  6 08:03:59 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.212.189.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
country_id: 1814991
description:
Feb  6 08:04:07 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
country_id: 1880251
description:
Feb  6 08:03:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.9
country_id: 1814991
description:
Feb  6 08:03:40 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
country_id: 1880251
description:
2025-02-06 08:03:40 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:49602: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
country_id: 1269750
description:
2025-02-06 08:03:58 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:40788: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Feb  6 08:04:01 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  6 08:04:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
country_id: 1269750
description:
Feb  6 08:03:56 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
country_id: 1814991
description:
2025-02-06 08:03:59 dovecot_plain authenticator failed for ([27.40.100.131]) [27.40.100.131]:56622: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.9
country_id: 1814991
description:
2025-02-06 08:03:42 dovecot_plain authenticator failed for ([112.102.48.9]) [112.102.48.9]:44872: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.117.195
country_id: 1814991
description:
Feb  6 08:03:45 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.117.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
country_id: 2661886
description:
Feb  6 08:03:53 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
country_id: 1814991
description:
Feb  6 08:04:00 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
country_id: 1668284
description:
2025-02-06 08:05:30 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:41198: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.243.253.237
country_id: 2017370
description:
[2025-02-06 08:05:34 +0100] info [webmaild] 46.243.253.237 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
country_id: 1814991
description:
Feb  6 08:04:38 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2025-02-06 08:04:40 dovecot_login authenticator failed for ([36.154.20.34]) [153.37.177.219]:22408: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.177.57.8
country_id: 3469034
description:
[2025-02-06 08:04:47 +0100] info [webmaild] 179.177.57.8 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 59.103.5.205
country_id: 1168579
description:
[2025-02-06 08:05:16 +0100] info [webmaild] 59.103.5.205 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
country_id: 1668284
description:
Feb  6 08:05:28 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
country_id: 3469034
description:
2025-02-06 08:05:39 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:46169: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
country_id: 3017382
description:
Feb  6 08:05:50 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.16.253
country_id: 927384
description:
Feb  6 08:06:00 ait sshd[1049935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.16.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
country_id: 1814991
description:
2025-02-06 08:06:06 dovecot_plain authenticator failed for ([218.206.136.24]) [218.206.136.24]:41804: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 08:05:41 ait sshd[1049843]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 08:05:41 ait sshd[1049843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-06 08:05:52 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:59439: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
country_id: 1814991
description:
Feb  6 08:06:04 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.47.164.10
country_id: 1210997
description:
[2025-02-06 08:06:07 +0100] info [webmaild] 202.47.164.10 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 08:06:20 ait sshd[1049985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.123.104
country_id: 1269750
description:
Feb  6 08:06:27 ait sshd[1049999]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.92.123.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
country_id: 732800
description:
Feb  6 08:06:35 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-02-06 08:06:13 dovecot_plain authenticator failed for (overs) [102.53.15.18]:55443: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
country_id: 732800
description:
2025-02-06 08:06:37 dovecot_login authenticator failed for ([185.255.212.146]) [185.255.212.146]:28595: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
country_id: 3469034
description:
Feb  6 08:05:37 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Feb  6 08:06:11 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 08:06:20 ait sshd[1049985]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
country_id: 1814991
description:
Feb  6 08:06:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.209.16.253
country_id: 927384
description:
Feb  6 08:06:00 ait sshd[1049935]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.209.16.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.92.123.104
country_id: 1269750
description:
Feb  6 08:06:27 ait sshd[1049999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.92.123.104  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-02-06 08:06:28 dovecot_login authenticator failed for ([180.168.100.230]) [180.168.100.230]:53997: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 08:07:15 ait sshd[1050438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
country_id: 1835841
description:
Feb  6 08:07:26 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-02-06 08:07:28 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:54654: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 08:07:15 ait sshd[1050438]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.97.26.228
country_id: 3469034
description:
[2025-02-06 08:07:17 +0100] info [webmaild] 179.97.26.228 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.128.27.106
country_id: 3175395
description:
Feb  6 08:07:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.128.27.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
country_id: 1269750
description:
2025-02-06 08:07:48 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:52812: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
country_id: 1814991
description:
2025-02-06 08:08:05 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:41137: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
country_id: 1835841
description:
Feb  6 08:07:41 ait sshd[1050694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
country_id: 1835841
description:
Feb  6 08:07:41 ait sshd[1050694]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
country_id: 1269750
description:
Feb  6 08:07:46 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.111.140
country_id: 6252001
description:
2025-02-06 08:07:50 dovecot_login authenticator failed for ([75.110.111.140]) [75.110.111.140]:59128: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
country_id: 1814991
description:
Feb  6 08:08:03 ait auth[1027004]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.196.3
country_id: 99237
description:
[2025-02-06 08:08:14 +0100] info [webmaild] 37.237.196.3 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


