# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Feb  5 14:33:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-05 14:33:27 dovecot_login authenticator failed for ([181.164.147.150]) [181.164.147.150]:13739: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.210.49
description:
2025-02-05 14:33:38 dovecot_plain authenticator failed for (abts-kk-static-49.210.166.122.airtelbroadband.in) [122.166.210.49]:37353: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Feb  5 14:33:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-02-05 14:33:48 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:49846: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
description:
2025-02-05 14:33:53 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:60342: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
description:
2025-02-05 14:33:58 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:34477: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.27.158.165
description:
2025-02-05 14:33:42 dovecot_plain authenticator failed for host-87-27-158-165.business.telecomitalia.it [87.27.158.165]:33650: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Feb  5 14:33:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-02-05 14:33:42 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:44856: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Feb  5 14:33:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.142.210.138
description:
2025-02-05 14:33:46 dovecot_plain authenticator failed for ([61.142.210.138]) [61.142.210.138]:52054: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
description:
Feb  5 14:33:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-02-05 14:33:22 dovecot_plain authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:31161: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Feb  5 14:33:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Feb  5 14:33:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
description:
Feb  5 14:33:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
description:
Feb  5 14:33:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.255.214.12
description:
[2025-02-05 14:33:58 +0100] info [webmaild] 149.255.214.12 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.217.86
description:
Feb  5 14:34:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.217.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Feb  5 14:34:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-02-05 14:34:02 dovecot_plain authenticator failed for ([39.174.90.43]) [39.174.90.43]:38598: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
description:
2025-02-05 14:34:04 dovecot_plain authenticator failed for ([183.167.217.86]) [183.167.217.86]:54405: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-05 14:34:05 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:46515: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
description:
2025-02-05 14:34:06 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:39745: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-02-05 14:34:11 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:42316: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-02-05 14:34:12 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:49335: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-05 14:34:16 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:48978: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Feb  5 14:34:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-02-05 14:34:48 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:49897: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.145.112.215
description:
[2025-02-05 14:34:58 +0100] info [webmaild] 103.145.112.215 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
description:
2025-02-05 14:35:01 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:43034: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Feb  5 14:34:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Feb  5 14:34:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.155.146
description:
Feb  5 14:34:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.165.232.229
description:
[2025-02-05 14:34:21 +0100] info [webmaild] 217.165.232.229 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-02-05 14:34:28 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:39076: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
description:
Feb  5 14:34:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
description:
Feb  5 14:34:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Feb  5 14:34:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Feb  5 14:34:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-02-05 14:34:08 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:64622: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  5 14:34:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
description:
2025-02-05 14:34:16 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:44185: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.20.248
description:
[2025-02-05 14:36:33 +0100] info [webmaild] 131.255.20.248 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.208.70.111
description:
[2025-02-05 14:36:53 +0100] info [webmaild] 186.208.70.111 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Feb  5 14:36:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.232.113
description:
Feb  5 14:36:04 ait sshd[601563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.232.113  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-02-05 14:36:16 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (cantion) [2.36.64.247]:36798: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.192.216
description:
[2025-02-05 14:36:05 +0100] info [webmaild] 160.238.192.216 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
description:
Feb  5 14:37:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
description:
2025-02-05 14:37:25 dovecot_login authenticator failed for ([207.102.66.226]) [207.102.66.226]:51974: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  5 14:37:03 ait sshd[602156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Feb  5 14:37:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.177.171.100
description:
[2025-02-05 14:37:24 +0100] info [webmaild] 160.177.171.100 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-02-05 14:37:35 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:49886: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-05 14:38:01 dovecot_plain authenticator failed for (semass) [185.65.238.250]:57424: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Feb  5 14:37:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.250.47.63
description:
[2025-02-05 14:38:37 +0100] info [webmaild] 186.250.47.63 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
description:
Feb  5 14:38:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
description:
2025-02-05 14:38:10 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (ovesia) [80.14.31.158]:57176: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.175.61.9
description:
Feb  5 14:39:21 ait sshd[603629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.175.61.9  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.39.100.243
description:
[2025-02-05 14:39:25 +0100] info [webmaild] 186.39.100.243 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.104.213.40
description:
[2025-02-05 14:39:05 +0100] info [webmaild] 191.104.213.40 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.43.40.236
description:
[2025-02-05 14:39:58 +0100] info [webmaild] 39.43.40.236 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-40.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
description:
2025-02-05 14:41:04 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:55904: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.39.230.40
description:
Feb  5 14:41:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.39.230.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.250.124
description:
[2025-02-05 14:41:42 +0100] info [webmaild] 170.239.250.124 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
description:
Feb  5 14:41:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.171.240
description:
[2025-02-05 14:41:15 +0100] info [webmaild] 181.115.171.240 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
description:
2025-02-05 14:41:16 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:2138: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Feb  5 14:42:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-02-05 14:42:30 dovecot_plain authenticator failed for (ditan) [41.248.243.181]:42702: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.12.170.135
description:
[2025-02-05 14:42:44 +0100] info [webmaild] 186.12.170.135 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 159.146.43.89
description:
[2025-02-05 14:42:19 +0100] info [webmaild] 159.146.43.89 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Feb  5 14:42:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  5 14:42:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-05 14:42:02 dovecot_plain authenticator failed for (nolagne) [64.72.74.162]:40421: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.6.225.90
description:
2025-02-05 14:43:30 dovecot_login authenticator failed for (90-225.adsl.static.espeed.com.bn) [61.6.225.90]:34488: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
description:
Feb  5 14:43:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.246.80.86
description:
[2025-02-05 14:43:42 +0100] info [webmaild] 190.246.80.86 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Feb  5 14:43:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-02-05 14:43:57 dovecot_login authenticator failed for ([60.167.19.189]) [60.167.19.189]:57722: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Feb  5 14:43:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.225.90
description:
Feb  5 14:43:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.225.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Feb  5 14:43:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
description:
2025-02-05 14:43:42 dovecot_login authenticator failed for ([211.44.80.68]) [211.44.80.68]:45034: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.42.40.17
description:
[2025-02-05 14:44:10 +0100] info [webmaild] 179.42.40.17 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.93.145.3
description:
[2025-02-05 14:44:43 +0100] info [webmaild] 191.93.145.3 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 14:45:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 14:45:34 ait sshd[607233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.8.115.96
description:
[2025-02-05 14:45:15 +0100] info [webmaild] 37.8.115.96 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  5 14:45:32 ait sshd[607091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-05 14:45:47 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:45730: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-02-05 14:45:57 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:34182: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  5 14:45:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Feb  5 14:45:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Feb  5 14:46:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  5 14:46:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-05 14:46:03 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:42325: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-02-05 14:46:16 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:52774: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.154.49.208
description:
[2025-02-05 14:46:41 +0100] info [webmaild] 103.154.49.208 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.62.56.65
description:
[2025-02-05 14:46:12 +0100] info [webmaild] 179.62.56.65 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.36.228
description:
[2025-02-05 14:47:47 +0100] info [webmaild] 45.6.36.228 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-02-05 14:47:50 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:38096: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.162.16.2
description:
Feb  5 14:47:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.162.16.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.123.14
description:
[2025-02-05 14:47:15 +0100] info [webmaild] 45.174.123.14 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.230
description:
Feb  5 14:47:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.230
description:
2025-02-05 14:47:36 dovecot_plain authenticator failed for (nsg-corporate-230.228.187.122.airtel.in) [122.187.228.230]:43302: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.162.16.2
description:
2025-02-05 14:47:12 dovecot_plain authenticator failed for syn-024-162-016-002.res.spectrum.com [24.162.16.2]:44613: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Feb  5 14:47:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.171.50.93
description:
[2025-02-05 14:48:41 +0100] info [webmaild] 31.171.50.93 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-02-05 14:48:43 dovecot_login authenticator failed for ([60.173.114.254]) [60.173.114.254]:39499: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Feb  5 14:48:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 14:48:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Feb  5 14:48:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-02-05 14:49:00 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:55184: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  5 14:49:18 ait sshd[609302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 14:49:29 ait sshd[609334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.179.170.153
description:
[2025-02-05 14:49:10 +0100] info [webmaild] 160.179.170.153 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.94.9.126
description:
[2025-02-05 14:49:47 +0100] info [webmaild] 109.94.9.126 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  5 14:49:18 ait sshd[609302]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
description:
Feb  5 14:50:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.253.221.145
description:
[2025-02-05 14:50:18 +0100] info [webmaild] 188.253.221.145 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.248.178.230
description:
2025-02-05 14:50:21 dovecot_plain authenticator failed for 60-248-178-230.hinet-ip.hinet.net [60.248.178.230]:46711: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-02-05 14:50:30 dovecot_login authenticator failed for ([62.76.95.152]) [62.76.95.152]:53970: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
description:
2025-02-05 14:50:03 dovecot_plain authenticator failed for ([220.77.182.169]) [220.77.182.169]:40496: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.196.137
description:
2025-02-05 14:50:16 dovecot_login authenticator failed for ([120.82.196.137]) [120.82.196.137]:48791: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Feb  5 14:50:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.196.137
description:
Feb  5 14:50:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.196.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.248.178.230
description:
Feb  5 14:50:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.248.178.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 14:50:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Feb  5 14:51:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-02-05 14:51:24 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:48820: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.33.81.218
description:
[2025-02-05 14:51:41 +0100] info [webmaild] 201.33.81.218 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.99.139.147
description:
[2025-02-05 14:51:12 +0100] info [webmaild] 138.99.139.147 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Feb  5 14:51:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-02-05 14:51:14 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:60875: 535 Incorrect authentication data (set_id=test@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-02-05 14:52:40 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:37389: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Feb  5 14:52:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  5 14:52:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 14:52:49 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:38592: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Feb  5 14:52:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-05 14:52:48 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:43024: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.239.51.94
description:
[2025-02-05 14:52:33 +0100] info [webmaild] 45.239.51.94 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 14:52:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.233.251
description:
Feb  5 14:52:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.233.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-02-05 14:53:59 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:48053: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.39.122.133
description:
[2025-02-05 14:53:09 +0100] info [webmaild] 102.39.122.133 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
description:
2025-02-05 14:53:11 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:50991: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Feb  5 14:53:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Feb  5 14:53:31 ait sshd[611283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 207.204.117.217
description:
[2025-02-05 14:53:43 +0100] info [webmaild] 207.204.117.217 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
description:
Feb  5 14:53:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Feb  5 14:53:31 ait sshd[611283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.222
description:
[2025-02-05 14:54:55 +0100] info [cpaneld] 104.207.53.222 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.247.80
description:
Feb  5 14:54:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.247.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
description:
Feb  5 14:54:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.81
description:
[2025-02-05 14:54:47 +0100] info [cpaneld] 156.228.83.81 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  5 14:54:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-05 14:54:36 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:40851: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.171
description:
[2025-02-05 14:54:47 +0100] info [cpaneld] 104.207.42.171 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.92.162
description:
[2025-02-05 14:54:48 +0100] info [cpaneld] 156.228.92.162 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.235.247.80
description:
2025-02-05 14:54:09 dovecot_plain authenticator failed for ([91.235.247.80]) [91.235.247.80]:54108: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.175.107.55
description:
[2025-02-05 14:54:13 +0100] info [webmaild] 109.175.107.55 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
description:
2025-02-05 14:54:19 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:39432: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.227.81.78
description:
[2025-02-05 14:55:08 +0100] info [webmaild] 168.227.81.78 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-55.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-02-05 14:55:21 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:53606: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.129.114
description:
Feb  5 14:55:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.129.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.216.198.213
description:
Feb  5 14:55:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.216.198.213 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.247
description:
[2025-02-05 14:55:03 +0100] info [cpaneld] 104.207.52.247 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.97.125
description:
[2025-02-05 14:55:05 +0100] info [whostmgrd] 156.228.97.125 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.196
description:
[2025-02-05 14:55:11 +0100] info [whostmgrd] 156.228.112.196 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
description:
Feb  5 14:55:18 ait sshd[612323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.129.114
description:
2025-02-05 14:55:27 dovecot_login authenticator failed for ([14.48.129.114]) [14.48.129.114]:57194: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-02-05 14:55:53 dovecot_plain authenticator failed for (qgy3dph74hesn8u4652x7) [77.40.62.195]:16761: 535 Incorrect authentication data (set_id=webmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.62
description:
Feb  5 14:55:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.179.212
description:
[2025-02-05 14:55:39 +0100] info [webmaild] 131.0.179.212 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-02-05 14:55:40 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:44652: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.216.198.213
description:
2025-02-05 14:55:55 dovecot_plain authenticator failed for c-84-216-198-213.bbcust.telenor.se (chide) [84.216.198.213]:55766: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Feb  5 14:55:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.78
description:
[2025-02-05 14:55:07 +0100] info [whostmgrd] 156.228.99.78 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.62
description:
2025-02-05 14:55:30 dovecot_plain authenticator failed for (chalan) [65.20.193.62]:42792: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.119.194
description:
2025-02-05 14:55:34 dovecot_plain authenticator failed for 194.79-161-119.customer.lyse.net (trailia) [79.161.119.194]:42300: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Feb  5 14:55:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.121
description:
[2025-02-05 14:55:06 +0100] info [whostmgrd] 156.228.96.121 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.199
description:
[2025-02-05 14:55:06 +0100] info [whostmgrd] 156.228.101.199 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-02-05 14:55:07 dovecot_login authenticator failed for ([220.185.225.50]) [220.185.225.50]:33128: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.84
description:
[2025-02-05 14:55:10 +0100] info [whostmgrd] 104.207.56.84 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.123.32
description:
Feb  5 14:55:13 ait sshd[612235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.123.32  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.123.32
description:
Feb  5 14:55:13 ait sshd[612235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Feb  5 14:55:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  5 14:56:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.244.3
description:
Feb  5 14:56:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.244.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-02-05 14:56:32 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:38489: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Feb  5 14:56:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-05 14:57:00 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:65277: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.204.60
description:
[2025-02-05 14:56:13 +0100] info [webmaild] 45.163.204.60 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.123
description:
2025-02-05 14:56:16 dovecot_login authenticator failed for ([197.255.143.123]) [197.255.143.123]:37423: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.47.246.138
description:
[2025-02-05 14:56:43 +0100] info [webmaild] 189.47.246.138 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 14:57:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-02-05 14:57:21 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:49764: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
description:
2025-02-05 14:57:37 dovecot_plain authenticator failed for ([94.207.226.113]) [94.207.226.113]:60761: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Feb  5 14:57:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.141.97.42
description:
[2025-02-05 14:57:54 +0100] info [webmaild] 41.141.97.42 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
description:
Feb  5 14:57:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.129.199
description:
2025-02-05 14:57:23 dovecot_plain authenticator failed for ([203.172.129.199]) [203.172.129.199]:33231: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Feb  5 14:57:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Feb  5 14:57:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-02-05 14:57:29 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:48630: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-02-05 14:57:39 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:47280: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.129.199
description:
Feb  5 14:57:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.129.199 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  5 14:58:19 ait sshd[613831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.80.245
description:
[2025-02-05 14:58:47 +0100] info [webmaild] 213.230.80.245 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Feb  5 14:58:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Feb  5 14:58:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
description:
2025-02-05 14:58:53 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:60074: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 14:58:06 ait sshd[613751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
description:
Feb  5 14:58:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-02-05 14:58:42 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:52866: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Feb  5 14:58:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
description:
2025-02-05 14:59:00 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:53468: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.167.237
description:
[2025-02-05 14:58:15 +0100] info [webmaild] 45.173.167.237 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
description:
2025-02-05 14:58:31 dovecot_plain authenticator failed for ([124.89.60.158]) [124.89.60.158]:52388: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
description:
Feb  5 14:58:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-02-05 14:59:00 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:51920: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  5 14:59:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
description:
Feb  5 14:59:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.57
description:
47.128.47.57 - - [05/Feb/2025:14:59:38 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4602239 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/singing/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.110.234.40
description:
Feb  5 14:59:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.110.234.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.110.234.40
description:
2025-02-05 14:59:11 dovecot_plain authenticator failed for (187.110.234.40.mobtelecom.com.br) [187.110.234.40]:36513: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-05 14:59:12 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:2985: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
description:
2025-02-05 14:59:16 dovecot_plain authenticator failed for ([211.53.58.10]) [211.53.58.10]:52050: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.59.244.105
description:
[2025-02-05 14:59:16 +0100] info [webmaild] 185.59.244.105 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 14:59:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
description:
Feb  5 14:59:15 ait sshd[614401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 15:00:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-05 15:00:32 dovecot_plain authenticator failed for (poidated) [185.65.238.250]:33516: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.250.229.161
description:
[2025-02-05 15:00:16 +0100] info [webmaild] 41.250.229.161 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Feb  5 15:00:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.30.253
description:
47.128.30.253 - - [05/Feb/2025:15:00:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22325203 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?filter_course-category=205&filtering=1&level=beginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.30.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
description:
2025-02-05 15:00:37 dovecot_plain authenticator failed for 176-170-1-244.abo.bbox.fr (unuchic) [176.170.1.244]:43688: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.7.2.182
description:
[2025-02-05 15:00:49 +0100] info [webmaild] 38.7.2.182 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
description:
2025-02-05 15:01:09 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:49494: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-02-05 15:01:27 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:45806: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-02-05 15:01:13 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:48849: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Feb  5 15:01:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-02-05 15:01:21 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:35917: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.166.229
description:
2025-02-05 15:01:47 dovecot_login authenticator failed for ([117.253.166.229]) [117.253.166.229]:36482: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Feb  5 15:01:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.7.244
description:
[2025-02-05 15:01:21 +0100] info [webmaild] 45.164.7.244 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Feb  5 15:01:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.15.96.26
description:
Feb  5 15:01:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.15.96.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-02-05 15:02:21 dovecot_login authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:35520: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
description:
Feb  5 15:02:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
description:
Feb  5 15:02:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.171.11
description:
[2025-02-05 15:02:59 +0100] info [webmaild] 45.186.171.11 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.43.241.176
description:
[2025-02-05 15:02:06 +0100] info [webmaild] 186.43.241.176 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Feb  5 15:02:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
description:
2025-02-05 15:02:26 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:56850: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
description:
2025-02-05 15:02:37 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:51072: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.194.28
description:
Feb  5 15:03:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.194.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.194.28
description:
2025-02-05 15:03:36 dovecot_plain authenticator failed for ([94.204.194.28]) [94.204.194.28]:56076: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-02-05 15:03:55 dovecot_plain authenticator failed for ([211.196.31.2]) [211.196.31.2]:39268: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Feb  5 15:03:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-02-05 15:03:28 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:52560: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.194.244
description:
[2025-02-05 15:03:55 +0100] info [webmaild] 45.182.194.244 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Feb  5 15:03:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.30.217.76
description:
[2025-02-05 15:03:33 +0100] info [webmaild] 147.30.217.76 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
description:
2025-02-05 15:03:52 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (aging) [73.195.211.98]:59156: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-02-05 15:03:58 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:33784: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Feb  5 15:04:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-02-05 15:04:07 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:60103: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-02-05 15:04:19 dovecot_plain authenticator failed for ([196.207.241.168]) [196.207.241.168]:33859: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.67.134.195
description:
[2025-02-05 15:04:26 +0100] info [webmaild] 105.67.134.195 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Feb  5 15:04:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.50.148
description:
Feb  5 15:04:21 ait sshd[616860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.50.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.211.97
description:
2025-02-05 15:04:38 dovecot_plain authenticator failed for (qtfjhlrdnajdyvymcs0p) [136.169.211.97]:13303: 535 Incorrect authentication data (set_id=webmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Feb  5 15:05:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.106.138.230
description:
[2025-02-05 15:05:36 +0100] info [webmaild] 85.106.138.230 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
description:
Feb  5 15:05:07 ait sshd[617371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  5 15:05:57 ait sshd[617722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.175.201.58
description:
Feb  5 15:06:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.175.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Feb  5 15:06:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.105.105.188
description:
Feb  5 15:06:16 ait sshd[617875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.105.105.188  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.210.10
description:
Feb  5 15:06:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.210.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.83.21.19
description:
[2025-02-05 15:06:23 +0100] info [webmaild] 80.83.21.19 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
description:
2025-02-05 15:06:34 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:52214: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.175.201.58
description:
2025-02-05 15:06:39 dovecot_plain authenticator failed for ([59.175.201.58]) [59.175.201.58]:44826: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 15:06:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.89.54.10
description:
Feb  5 15:06:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.89.54.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.105.105.188
description:
Feb  5 15:06:16 ait sshd[617875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.105.105.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.101.207
description:
[2025-02-05 15:06:56 +0100] info [webmaild] 177.73.101.207 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.128.85
description:
[2025-02-05 15:06:16 +0100] info [webmaild] 181.116.128.85 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.54.10
description:
2025-02-05 15:06:15 dovecot_plain authenticator failed for ip10.ip-51-89-54.eu [51.89.54.10]:55341: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
description:
2025-02-05 15:06:22 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:39630: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 15:06:24 ait sshd[617912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.84.34.85
description:
Feb  5 15:06:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.84.34.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  5 15:06:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-05 15:06:42 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:56394: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.227.153.51
description:
Feb  5 15:07:53 ait sshd[618603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.227.153.51


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.135.252.202
description:
[2025-02-05 15:08:12 +0100] info [webmaild] 2.135.252.202 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.20.130
description:
Feb  5 15:08:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Feb  5 15:08:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.20.130
description:
2025-02-05 15:08:33 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:41032: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-02-05 15:08:44 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:45796: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.238.92
description:
[2025-02-05 15:08:49 +0100] info [webmaild] 45.174.238.92 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.62.63.232
description:
[2025-02-05 15:09:01 +0100] info [webmaild] 41.62.63.232 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.105.105.188
description:
Feb  5 15:09:44 ait sshd[619474]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.105.105.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.50.148
description:
Feb  5 15:09:20 ait sshd[619381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.50.148


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 15:09:46 ait sshd[619489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Feb  5 15:09:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
description:
Feb  5 15:09:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.227.153.51
description:
Feb  5 15:09:47 ait sshd[619492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.227.153.51


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.244
description:
Feb  5 15:09:51 ait sshd[619505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
description:
2025-02-05 15:09:28 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:54442: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.147.188.101
description:
[2025-02-05 15:09:34 +0100] info [webmaild] 186.147.188.101 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.105.105.188
description:
Feb  5 15:09:44 ait sshd[619474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.105.105.188  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  5 15:09:26 ait sshd[619392]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.50.148
description:
Feb  5 15:10:42 ait sshd[620025]: Failed password for invalid user tomcat from 162.240.50.148 port 43606 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Feb  5 15:10:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.227.153.51
description:
Feb  5 15:10:58 ait sshd[620400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.227.153.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-02-05 15:10:01 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:45336: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.50.148
description:
Feb  5 15:10:40 ait sshd[620025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.50.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.216.54
description:
[2025-02-05 15:10:48 +0100] info [webmaild] 170.83.216.54 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-02-05 15:10:49 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:43390: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Feb  5 15:10:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-02-05 15:10:21 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:51394: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Feb  5 15:10:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-02-05 15:10:40 dovecot_plain authenticator failed for (somegaiid) [93.159.152.6]:53282: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 15:11:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Feb  5 15:11:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.86.58.117
description:
2025-02-05 15:11:10 dovecot_plain authenticator failed for ([222.86.58.117]) [222.86.58.117]:57524: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
description:
Feb  5 15:11:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.181.143
description:
[2025-02-05 15:11:24 +0100] info [webmaild] 45.237.181.143 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Feb  5 15:11:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-02-05 15:11:22 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com (098-010-121-246.res.spectrum.com) [98.10.121.246]:57353: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
description:
Feb  5 15:11:33 ait sshd[620655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.244
description:
Feb  5 15:11:59 ait sshd[620840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.244


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.86.58.117
description:
Feb  5 15:11:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.86.58.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.105.105.188
description:
Feb  5 15:11:14 ait sshd[620560]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.105.105.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.231.235.45
description:
[2025-02-05 15:11:30 +0100] info [webmaild] 181.231.235.45 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.105.105.188
description:
Feb  5 15:11:14 ait sshd[620560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.105.105.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.137.21
description:
Feb  5 15:11:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.137.21 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.181.142.244
description:
Feb  5 15:12:01 ait sshd[620840]: Failed password for invalid user mani from 103.181.142.244 port 53670 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.217.166
description:
2025-02-05 15:12:39 dovecot_plain authenticator failed for ([119.164.217.166]) [119.164.217.166]:53628: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  5 15:12:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.179.37.140
description:
[2025-02-05 15:12:02 +0100] info [webmaild] 201.179.37.140 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
description:
2025-02-05 15:12:21 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:48308: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
description:
Feb  5 15:12:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
description:
Feb  5 15:12:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-02-05 15:12:34 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:49184: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Feb  5 15:12:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-02-05 15:12:34 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:58758: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-02-05 15:12:39 dovecot_plain authenticator failed for (fragal) [102.53.15.17]:33609: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Feb  5 15:12:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
description:
Feb  5 15:12:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
description:
2025-02-05 15:12:52 dovecot_plain authenticator failed for ([211.53.58.10]) [211.53.58.10]:50746: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Feb  5 15:12:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Feb  5 15:12:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-05 15:12:54 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:41034: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.40.194
description:
Feb  5 15:13:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.248.40.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 15:13:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-02-05 15:13:33 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:43890: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
description:
Feb  5 15:13:47 ait sshd[621752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.206.234.251
description:
[2025-02-05 15:13:52 +0100] info [webmaild] 5.206.234.251 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Feb  5 15:13:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.63.136.218
description:
Feb  5 15:13:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.63.136.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.63.136.218
description:
2025-02-05 15:13:34 dovecot_plain authenticator failed for ([183.63.136.218]) [183.63.136.218]:48562: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.244
description:
Feb  5 15:13:36 ait sshd[621649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.244  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Feb  5 15:13:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-02-05 15:13:43 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:38272: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
description:
Feb  5 15:13:47 ait sshd[621752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.121.5
description:
[2025-02-05 15:13:15 +0100] info [webmaild] 169.224.121.5 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.40.194
description:
2025-02-05 15:13:21 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:34704: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 15:14:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
description:
2025-02-05 15:14:08 dovecot_login authenticator failed for 229.sub-166-141-241.myvzw.com [166.141.241.229]:46566: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.199.10
description:
[2025-02-05 15:14:12 +0100] info [webmaild] 138.59.199.10 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Feb  5 15:14:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.141.241.229
description:
Feb  5 15:14:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.141.241.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-02-05 15:14:19 dovecot_login authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:36267: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.76.238.38
description:
[2025-02-05 15:14:41 +0100] info [webmaild] 87.76.238.38 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Feb  5 15:15:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-05 15:15:35 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:54888: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.248.212.34
description:
[2025-02-05 15:15:49 +0100] info [webmaild] 154.248.212.34 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Feb  5 15:15:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
description:
Feb  5 15:15:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  5 15:15:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  5 15:15:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-05 15:15:34 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:52266: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Feb  5 15:15:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-02-05 15:15:57 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:46022: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
description:
2025-02-05 15:15:10 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:36536: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-02-05 15:15:24 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:42218: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Feb  5 15:17:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Feb  5 15:17:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.116.233.157
description:
[2025-02-05 15:17:18 +0100] info [webmaild] 186.116.233.157 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Feb  5 15:17:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Feb  5 15:17:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.0.126.91
description:
Feb  5 15:17:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.0.126.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
description:
2025-02-05 15:17:03 dovecot_plain authenticator failed for ([66.90.89.66]) [66.90.89.66]:46478: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-02-05 15:17:17 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:46958: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Feb  5 15:17:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-02-05 15:17:43 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:40722: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-02-05 15:17:21 dovecot_plain authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:24140: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Feb  5 15:17:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-02-05 15:18:41 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:60462: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.66.113.58
description:
Feb  5 15:18:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.66.113.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
description:
2025-02-05 15:18:21 dovecot_plain authenticator failed for ([183.66.113.58]) [183.66.113.58]:58148: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
description:
Feb  5 15:18:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
description:
2025-02-05 15:18:26 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:55256: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  5 15:18:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.142.210.138
description:
Feb  5 15:18:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.142.210.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.52.218
description:
Feb  5 15:18:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.52.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Feb  5 15:18:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 15:18:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.32.11
description:
[2025-02-05 15:18:31 +0100] info [webmaild] 186.158.32.11 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.142.210.138
description:
2025-02-05 15:18:41 dovecot_plain authenticator failed for ([61.142.210.138]) [61.142.210.138]:50380: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-02-05 15:18:46 dovecot_plain authenticator failed for ([102.215.188.37]) [102.215.188.37]:45131: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Feb  5 15:18:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-05 15:18:35 dovecot_plain authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:44144: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Feb  5 15:18:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
description:
Feb  5 15:18:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Feb  5 15:18:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.52.218
description:
2025-02-05 15:18:54 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no (terenduous) [94.246.52.218]:37288: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Feb  5 15:19:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
description:
Feb  5 15:19:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.232.103.100
description:
[2025-02-05 15:19:26 +0100] info [webmaild] 188.232.103.100 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
description:
2025-02-05 15:19:36 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:61723: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Feb  5 15:19:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.59.90.121
description:
Feb  5 15:19:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.59.90.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.3.115
description:
[2025-02-05 15:19:53 +0100] info [webmaild] 179.48.3.115 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.121
description:
2025-02-05 15:19:47 dovecot_plain authenticator failed for h-46-59-90-121.a463.priv.bahnhof.se [46.59.90.121]:54361: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 15:19:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.107.64.74
description:
[2025-02-05 15:19:06 +0100] info [webmaild] 85.107.64.74 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  5 15:20:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  5 15:20:21 ait sshd[625224]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  5 15:20:21 ait sshd[625224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 15:20:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.221.223.159
description:
Feb  5 15:20:13 ait sshd[625192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.221.223.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.221.223.159
description:
Feb  5 15:20:13 ait sshd[625192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.221.223.159  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.27.132
description:
Feb  5 15:20:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.27.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-02-05 15:21:46 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:42674: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 15:21:13 ait sshd[625759]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 15:21:13 ait sshd[625759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-02-05 15:21:31 dovecot_plain authenticator failed for ([122.187.243.95]) [122.187.243.95]:57956: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-02-05 15:21:44 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:49564: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Feb  5 15:21:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.153.14
description:
[2025-02-05 15:21:06 +0100] info [webmaild] 181.191.153.14 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.88.67.1
description:
Feb  5 15:21:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.88.67.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Feb  5 15:21:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-05 15:21:21 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:48292: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.88.67.1
description:
2025-02-05 15:21:31 dovecot_plain authenticator failed for (wtl.worldcall.net.pk) [111.88.67.1]:46221: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-02-05 15:21:35 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:50763: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Feb  5 15:21:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Feb  5 15:21:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-02-05 15:21:11 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:35935: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Feb  5 15:21:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.62.202
description:
[2025-02-05 15:21:53 +0100] info [webmaild] 170.244.62.202 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  5 15:21:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-05 15:21:06 dovecot_plain authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:58944: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  5 15:21:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.19.67
description:
[2025-02-05 15:21:41 +0100] info [webmaild] 188.163.19.67 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 15:22:30 ait sshd[626205]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 15:22:30 ait sshd[626205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.235.26.118
description:
[2025-02-05 15:22:35 +0100] info [webmaild] 105.235.26.118 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 15:22:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  5 15:22:20 ait sshd[626228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  5 15:22:20 ait sshd[626228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-02-05 15:23:59 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:56994: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Feb  5 15:23:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-02-05 15:23:04 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:51456: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-02-05 15:23:47 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:56582: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Feb  5 15:23:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-02-05 15:23:55 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:44678: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-02-05 15:23:17 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:51198: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Feb  5 15:23:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.196.175
description:
Feb  5 15:23:46 ait sshd[626957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.196.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Feb  5 15:23:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.100.161
description:
[2025-02-05 15:23:39 +0100] info [webmaild] 181.78.100.161 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.196.175
description:
Feb  5 15:23:46 ait sshd[626957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.196.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  5 15:23:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-05 15:23:55 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:36509: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Feb  5 15:23:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 15:24:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.121.53.76
description:
Feb  5 15:24:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.121.53.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.17.43
description:
[2025-02-05 15:24:22 +0100] info [webmaild] 132.255.17.43 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Feb  5 15:24:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.152
description:
2025-02-05 15:24:36 dovecot_plain authenticator failed for 111-70-22-152.emome-ip.hinet.net [111.70.22.152]:38639: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-02-05 15:24:37 dovecot_login authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:34762: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 15:24:10 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:45097: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
description:
Feb  5 15:24:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
description:
Feb  5 15:24:34 ait sshd[627526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.112.206.223
description:
Feb  5 15:24:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.112.206.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Feb  5 15:24:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.152
description:
Feb  5 15:24:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-02-05 15:24:14 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:42122: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
description:
Feb  5 15:24:34 ait sshd[627526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Feb  5 15:24:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-24.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
description:
Feb  5 15:24:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.149.10
description:
Feb  5 15:24:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.149.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.53.76
description:
2025-02-05 15:24:25 dovecot_plain authenticator failed for ([24.121.53.76]) [24.121.53.76]:59910: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
description:
Feb  5 15:24:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.156.190.215
description:
[2025-02-05 15:24:15 +0100] info [webmaild] 102.156.190.215 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-02-05 15:24:16 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:14314: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Feb  5 15:24:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
description:
2025-02-05 15:24:15 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:42910: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-02-05 15:24:56 dovecot_login authenticator failed for ([112.194.139.55]) [112.194.139.55]:34214: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
description:
2025-02-05 15:24:11 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:42185: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.206.223
description:
2025-02-05 15:24:59 dovecot_login authenticator failed for p163224-obmd01.osaka.ocn.ne.jp [61.112.206.223]:50704: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
description:
2025-02-05 15:25:00 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:44564: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.217.67
description:
[2025-02-05 15:24:53 +0100] info [webmaild] 143.255.217.67 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.149.10
description:
2025-02-05 15:24:11 dovecot_plain authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:40142: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
description:
Feb  5 15:24:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Feb  5 15:25:30 ait sshd[628112]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-02-05 15:25:17 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:35847: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.148.106
description:
Feb  5 15:25:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.148.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Feb  5 15:25:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.76
description:
Feb  5 15:25:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.246.82
description:
2025-02-05 15:25:23 dovecot_login authenticator failed for p59082-obmd01.osaka.ocn.ne.jp [153.141.246.82]:60542: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.141.228.9
description:
Feb  5 15:25:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.141.228.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
description:
2025-02-05 15:25:25 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:41746: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  5 15:25:30 ait sshd[628112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-05 15:25:46 dovecot_login authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:51609: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.159.139.135
description:
Feb  5 15:25:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.159.139.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.206.62.162
description:
Feb  5 15:25:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.206.62.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  5 15:25:33 ait sshd[628144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Feb  5 15:25:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-02-05 15:25:38 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:50164: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Feb  5 15:25:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  5 15:25:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.246.82
description:
Feb  5 15:25:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.76
description:
2025-02-05 15:25:28 dovecot_login authenticator failed for ([183.204.41.76]) [183.204.41.76]:38553: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.141.228.9
description:
2025-02-05 15:25:58 dovecot_login authenticator failed for (109x195x245x27.static-business.cheb.ertelecom.ru) [95.141.228.9]:56176: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.159.139.135
description:
2025-02-05 15:26:00 dovecot_login authenticator failed for (135.139-159-67.res.dyn.surewest.net) [67.159.139.135]:59662: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-05 15:25:33 dovecot_login authenticator failed for ([222.103.235.223]) [222.103.235.223]:53316: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  5 15:25:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  5 15:25:33 ait sshd[628144]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  5 15:25:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-05 15:25:14 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:59066: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-02-05 15:25:21 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:58298: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-02-05 15:25:42 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:58870: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
description:
Feb  5 15:25:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Feb  5 15:25:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.121.209.13
description:
[2025-02-05 15:26:14 +0100] info [webmaild] 168.121.209.13 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.108.173.17
description:
[2025-02-05 15:26:49 +0100] info [webmaild] 131.108.173.17 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.15
description:
[2025-02-05 15:26:54 +0100] info [webmaild] 213.230.87.15 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-05 15:26:03 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.157.125]:36344: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
description:
2025-02-05 15:26:12 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:57326: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  5 15:26:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-05 15:26:21 dovecot_login authenticator failed for ([222.103.235.223]) [222.103.235.223]:54974: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  5 15:26:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
description:
Feb  5 15:26:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
description:
2025-02-05 15:27:47 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:38310: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.13.237.163
description:
Feb  5 15:27:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.13.237.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
description:
Feb  5 15:27:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Feb  5 15:27:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  5 15:27:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.186.8
description:
Feb  5 15:27:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.186.8 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.23.61.165
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:wadminw||WPU:wadminw||RSV:6.65||T:APACHE||MV:15-27.94.23.61.165


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  5 15:27:26 ait sshd[629134]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  5 15:27:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-05 15:27:31 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:59794: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
description:
Feb  5 15:27:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
description:
Feb  5 15:27:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.206.105.37
description:
Feb  5 15:27:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.206.105.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
description:
2025-02-05 15:27:58 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:57462: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.243.163
description:
Feb  5 15:27:18 ait sshd[628951]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.243.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.206.105.37
description:
2025-02-05 15:27:31 dovecot_plain authenticator failed for ([10.13.105.93]) [195.206.105.37]:59120: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
description:
2025-02-05 15:27:38 dovecot_plain authenticator failed for ([130.185.96.113]) [130.185.96.113]:43532: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.186.8
description:
2025-02-05 15:27:54 dovecot_login authenticator failed for ([163.142.186.8]) [163.142.186.8]:42156: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
description:
2025-02-05 15:27:28 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:57414: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-02-05 15:27:32 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:55998: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-05 15:27:44 dovecot_login authenticator failed for ([222.236.59.174]) [222.236.59.174]:50936: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 15:27:26 ait sshd[629134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.203.125.141
description:
[2025-02-05 15:27:26 +0100] info [webmaild] 37.203.125.141 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.113
description:
Feb  5 15:27:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.13.237.163
description:
2025-02-05 15:27:46 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:57084: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.243.163
description:
Feb  5 15:27:18 ait sshd[628951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.243.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-02-05 15:28:21 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:52544: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.31.89
description:
[2025-02-05 15:28:42 +0100] info [webmaild] 170.233.31.89 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
description:
Feb  5 15:28:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
description:
Feb  5 15:28:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.132.229.196
description:
Feb  5 15:28:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.132.229.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Feb  5 15:28:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-02-05 15:28:31 dovecot_login authenticator failed for ([196.191.212.232]) [196.191.212.232]:54506: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
description:
2025-02-05 15:28:06 dovecot_plain authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:22232: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
description:
Feb  5 15:28:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
description:
2025-02-05 15:28:19 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:29079: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.132.229.196
description:
2025-02-05 15:28:26 dovecot_login authenticator failed for ([185.132.229.196]) [185.132.229.196]:43704: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Feb  5 15:28:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-02-05 15:28:57 dovecot_plain authenticator failed for (scoutrymic) [185.113.51.55]:37603: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.196.175
description:
Feb  5 15:29:10 ait sshd[629926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.196.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.97.52.145
description:
[2025-02-05 15:29:17 +0100] info [webmaild] 105.97.52.145 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Feb  5 15:29:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-02-05 15:29:42 dovecot_login authenticator failed for ([59.46.185.130]) [59.46.185.130]:40917: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.76.39
description:
[2025-02-05 15:29:46 +0100] info [webmaild] 37.239.76.39 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Feb  5 15:29:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.142.28.55
description:
[2025-02-05 15:29:58 +0100] info [webmaild] 187.142.28.55 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.196.175
description:
Feb  5 15:29:10 ait sshd[629926]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.196.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-02-05 15:29:05 dovecot_login authenticator failed for ([1.237.137.30]) [1.237.137.30]:46538: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
description:
2025-02-05 15:30:47 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:46267: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-05 15:30:48 dovecot_login authenticator failed for ([196.200.227.78]) [196.200.227.194]:44372: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
description:
2025-02-05 15:30:23 dovecot_login authenticator failed for ([182.176.150.182]) [182.176.150.182]:60833: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.167.114.221
description:
Feb  5 15:30:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.167.114.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
description:
Feb  5 15:30:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.150.182
description:
Feb  5 15:30:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.150.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  5 15:30:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
description:
2025-02-05 15:31:33 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:44285: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Feb  5 15:31:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
description:
Feb  5 15:31:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  5 15:31:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-02-05 15:31:32 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:18619: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  5 15:31:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-02-05 15:31:42 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:52698: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Feb  5 15:31:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-02-05 15:31:17 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:40642: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-02-05 15:31:19 dovecot_plain authenticator failed for ([1.180.230.98]) [1.180.230.98]:49893: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-02-05 15:31:33 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:59777: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-02-05 15:31:21 dovecot_plain authenticator failed for ([211.35.237.38]) [211.35.237.38]:53266: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Feb  5 15:31:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.40.138
description:
Feb  5 15:31:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.40.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-02-05 15:31:38 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:25317: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-02-05 15:31:24 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:46264: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.30.60.14
description:
[2025-02-05 15:31:27 +0100] info [webmaild] 147.30.60.14 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Feb  5 15:31:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Feb  5 15:31:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
description:
Feb  5 15:31:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Feb  5 15:31:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-05 15:31:33 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:60826: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Feb  5 15:31:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Feb  5 15:31:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.135.194
description:
Feb  5 15:31:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.135.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.47.199
description:
Feb  5 15:31:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.47.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
description:
2025-02-05 15:31:02 dovecot_login authenticator failed for (leased-line-93-125-83-110.telecom.by) [91.149.142.21]:38845: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Feb  5 15:31:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-02-05 15:31:22 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:58580: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-02-05 15:32:45 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:21017: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-02-05 15:32:47 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:9858: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.158
description:
Feb  5 15:32:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-05 15:32:56 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:36796: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-02-05 15:32:42 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:48120: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.235.179.225
description:
2025-02-05 15:32:46 dovecot_plain authenticator failed for ([117.235.179.225]) [117.235.179.225]:54103: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-02-05 15:32:48 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:51650: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.194.116
description:
Feb  5 15:32:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.194.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
description:
Feb  5 15:32:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
description:
Feb  5 15:32:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.170.139
description:
Feb  5 15:32:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.170.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.183.192.37
description:
[2025-02-05 15:32:35 +0100] info [webmaild] 38.183.192.37 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
description:
Feb  5 15:32:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
description:
2025-02-05 15:32:52 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:57878: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Feb  5 15:32:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-02-05 15:32:33 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:51994: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-02-05 15:32:43 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:41083: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
description:
2025-02-05 15:32:44 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:42864: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
description:
2025-02-05 15:32:48 dovecot_plain authenticator failed for ([110.14.192.20]) [110.14.192.20]:42158: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
description:
2025-02-05 15:33:00 dovecot_plain authenticator failed for ([222.190.110.210]) [222.190.110.210]:60109: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  5 15:32:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  5 15:32:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Feb  5 15:32:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-02-05 15:32:51 dovecot_login authenticator failed for ([5.30.191.129]) [5.30.191.129]:43442: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Feb  5 15:32:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 148.222.199.123
description:
[2025-02-05 15:32:02 +0100] info [webmaild] 148.222.199.123 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.182
description:
Feb  5 15:32:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
description:
2025-02-05 15:32:47 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:33104: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
description:
2025-02-05 15:32:47 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:53116: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-02-05 15:32:49 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:42188: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Feb  5 15:32:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
description:
2025-02-05 15:32:56 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:10236: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.104.200.24
description:
[2025-02-05 15:32:02 +0100] info [webmaild] 85.104.200.24 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  5 15:32:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  5 15:32:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.228
description:
2025-02-05 15:32:48 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:55186: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-05 15:32:54 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:45434: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
description:
Feb  5 15:32:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Feb  5 15:32:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Feb  5 15:32:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-02-05 15:32:40 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:52655: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  5 15:32:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Feb  5 15:32:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
description:
Feb  5 15:32:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
description:
2025-02-05 15:33:00 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:55801: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
description:
2025-02-05 15:32:44 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:64705: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-05 15:32:45 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:51832: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.124.13
description:
2025-02-05 15:32:46 dovecot_plain authenticator failed for ([163.179.124.13]) [163.179.124.13]:34535: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
description:
2025-02-05 15:32:47 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:41766: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-02-05 15:32:48 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:35812: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-05 15:32:57 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:12908: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-02-05 15:32:59 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:54702: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.92.193
description:
Feb  5 15:32:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.92.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.1.10
description:
2025-02-05 15:32:45 dovecot_plain authenticator failed for pool-100-37-1-10.nycmny.fios.verizon.net [100.37.1.10]:51224: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-02-05 15:32:54 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:47423: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Feb  5 15:32:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Feb  5 15:32:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-02-05 15:32:44 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:58298: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
description:
Feb  5 15:32:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Feb  5 15:32:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-02-05 15:32:57 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:36316: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-02-05 15:32:58 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:52044: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
description:
Feb  5 15:32:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.235.179.225
description:
Feb  5 15:32:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.235.179.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
description:
2025-02-05 15:32:53 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:58704: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.250.78
description:
Feb  5 15:32:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.250.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Feb  5 15:32:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Feb  5 15:32:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
description:
Feb  5 15:32:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
description:
2025-02-05 15:32:47 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:49652: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Feb  5 15:32:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
description:
Feb  5 15:32:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 15:33:00 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:53500: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  5 15:32:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
description:
2025-02-05 15:32:46 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:59855: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.2
description:
2025-02-05 15:32:48 dovecot_plain authenticator failed for ([58.122.255.2]) [58.122.255.2]:35164: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-02-05 15:32:56 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:57467: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-02-05 15:32:38 dovecot_login authenticator failed for ([75.110.132.232]) [75.110.132.232]:63140: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  5 15:32:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Feb  5 15:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.2
description:
Feb  5 15:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-05 15:32:07 dovecot_plain authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.229]:37491: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-05 15:32:42 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:49916: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.124.13
description:
Feb  5 15:32:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.124.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.158.55.193
description:
Feb  5 15:32:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.158.55.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Feb  5 15:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
description:
Feb  5 15:32:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.194.116
description:
2025-02-05 15:32:53 dovecot_login authenticator failed for ([120.234.194.116]) [120.234.194.116]:58643: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.228
description:
Feb  5 15:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
description:
Feb  5 15:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-05 15:32:55 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:65168: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Feb  5 15:32:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 100.37.1.10
description:
Feb  5 15:32:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 100.37.1.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-05 15:32:44 dovecot_login authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:50554: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-05 15:32:48 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:53434: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Feb  5 15:32:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.192.68
description:
Feb  5 15:32:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.192.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
description:
Feb  5 15:32:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
description:
2025-02-05 15:32:54 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:45600: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Feb  5 15:32:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
description:
2025-02-05 15:32:50 dovecot_plain authenticator failed for ([2.192.20.166]) [2.192.20.166]:36232: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
description:
Feb  5 15:32:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Feb  5 15:32:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
description:
2025-02-05 15:32:46 dovecot_plain authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:54466: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.159
description:
2025-02-05 15:32:48 dovecot_plain authenticator failed for ([45.71.58.159]) [45.71.58.159]:52408: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
description:
2025-02-05 15:32:55 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:53910: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
description:
Feb  5 15:32:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
description:
2025-02-05 15:32:46 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:34065: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
description:
2025-02-05 15:32:53 dovecot_plain authenticator failed for 111-70-29-158.emome-ip.hinet.net [111.70.29.158]:60667: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
description:
2025-02-05 15:32:53 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:37301: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 15:32:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
description:
Feb  5 15:32:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.189.211.114
description:
Feb  5 15:32:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.189.211.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  5 15:32:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-02-05 15:32:53 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:45602: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.158.55.193
description:
2025-02-05 15:33:00 dovecot_plain authenticator failed for (193.55.158.104.in-addr.arpa) [104.158.55.193]:50346: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-02-05 15:32:44 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:43230: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
description:
Feb  5 15:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Feb  5 15:32:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  5 15:32:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-02-05 15:33:09 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:40553: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS23B00223Y||WPU:ADS23B00223Y||RSV:6.65||T:APACHE||MV:15-33.204.10.194.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Feb  5 15:33:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  5 15:33:43 ait sshd[632345]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
description:
2025-02-05 15:33:02 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:33996: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.58
description:
2025-02-05 15:33:05 dovecot_plain authenticator failed for ([91.227.31.58]) [91.227.31.58]:52975: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.6.119
description:
Feb  5 15:33:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.6.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Feb  5 15:33:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.1.50
description:
2025-02-05 15:33:15 dovecot_plain authenticator failed for ([113.140.1.50]) [113.140.1.50]:36505: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
description:
Feb  5 15:33:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.100.253
description:
Feb  5 15:33:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.100.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  5 15:33:43 ait sshd[632345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  5 15:33:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.190
description:
Feb  5 15:33:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Feb  5 15:33:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-02-05 15:33:05 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:42887: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Feb  5 15:33:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Feb  5 15:33:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Feb  5 15:33:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
description:
2025-02-05 15:33:07 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:41163: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Feb  5 15:33:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-02-05 15:33:12 dovecot_plain authenticator failed for ([218.25.233.2]) [218.25.233.22]:58387: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-02-05 15:33:17 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:9212: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Feb  5 15:33:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
description:
2025-02-05 15:33:45 dovecot_plain authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:48758: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.170.139
description:
Feb  5 15:33:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.170.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-02-05 15:33:05 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:34980: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-05 15:33:06 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:13882: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.24.93
description:
2025-02-05 15:33:10 dovecot_plain authenticator failed for ([218.149.24.93]) [218.149.24.93]:41160: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.237.145.18
description:
2025-02-05 15:33:11 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:53212: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Feb  5 15:33:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Feb  5 15:33:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.129
description:
Feb  5 15:33:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Feb  5 15:33:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.190
description:
2025-02-05 15:33:19 dovecot_plain authenticator failed for ([122.187.229.190]) [122.187.229.190]:45139: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-02-05 15:33:20 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:34686: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-02-05 15:33:21 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:47414: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
description:
Feb  5 15:33:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.245.66
description:
Feb  5 15:33:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.245.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.58
description:
Feb  5 15:33:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-05 15:33:04 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:37837: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.195.67.82
description:
Feb  5 15:33:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.195.67.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-02-05 15:33:01 dovecot_plain authenticator failed for ([220.248.205.15]) [220.248.205.14]:1365: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  5 15:33:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
description:
2025-02-05 15:33:09 dovecot_plain authenticator failed for ([200.195.67.82]) [200.195.67.82]:59466: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.233.108
description:
2025-02-05 15:33:09 dovecot_plain authenticator failed for bb116-14-233-108.singnet.com.sg [116.14.233.108]:53354: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.253.67
description:
Feb  5 15:33:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.253.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Feb  5 15:33:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Feb  5 15:33:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-02-05 15:33:09 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:37882: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-02-05 15:33:11 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:35796: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.192.68
description:
2025-02-05 15:33:01 dovecot_plain authenticator failed for (68.192.34.58.broad.xw.sh.dynamic.163data.com.cn) [58.34.192.68]:47211: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
description:
Feb  5 15:33:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.91.96.58
description:
2025-02-05 15:33:08 dovecot_plain authenticator failed for ([222.91.96.58]) [222.91.96.58]:59248: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.24.93
description:
Feb  5 15:33:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.24.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.145.18
description:
Feb  5 15:33:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.145.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.245.66
description:
2025-02-05 15:33:02 dovecot_plain authenticator failed for ([120.238.245.66]) [120.238.245.66]:39533: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.32.11.3
description:
Feb  5 15:33:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.32.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  5 15:33:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-05 15:33:06 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:35608: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
description:
2025-02-05 15:33:29 dovecot_plain authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:49892: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Feb  5 15:33:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-02-05 15:33:43 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:40426: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Feb  5 15:33:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.73.139
description:
Feb  5 15:33:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.73.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
description:
Feb  5 15:33:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-02-05 15:33:03 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:45312: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.73.139
description:
2025-02-05 15:33:03 dovecot_plain authenticator failed for (139.73.34.171.adsl-pool.jx.chinaunicom.com) [171.34.73.139]:1114: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-02-05 15:33:07 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:51974: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
description:
2025-02-05 15:33:07 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:60898: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
description:
Feb  5 15:33:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-02-05 15:33:57 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:45140: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.20.130
description:
Feb  5 15:33:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-05 15:33:01 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:25507: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.20.130
description:
2025-02-05 15:33:03 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:58384: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
description:
2025-02-05 15:33:05 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:51073: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-02-05 15:33:10 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:33232: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.1.50
description:
Feb  5 15:33:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.1.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
description:
Feb  5 15:33:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-02-05 15:33:24 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (protert) [94.45.76.149]:39086: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.129
description:
2025-02-05 15:33:02 dovecot_plain authenticator failed for ([2.55.88.129]) [2.55.88.129]:57567: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Feb  5 15:33:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.32.11.3
description:
2025-02-05 15:33:04 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:31205: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.243.64
description:
Feb  5 15:33:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.243.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.233.108
description:
Feb  5 15:33:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.233.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
description:
2025-02-05 15:33:08 dovecot_plain authenticator failed for (119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:51795: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Feb  5 15:33:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
description:
2025-02-05 15:33:26 dovecot_plain authenticator failed for ([183.123.27.87]) [183.123.27.87]:43738: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-02-05 15:33:41 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:16240: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.241.9
description:
[2025-02-05 15:34:08 +0100] info [webmaild] 187.62.241.9 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
description:
Feb  5 15:34:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.43
description:
[2025-02-05 15:34:49 +0100] info [webmaild] 84.54.72.43 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
description:
2025-02-05 15:34:40 dovecot_plain authenticator failed for (terseally) [65.20.147.45]:50649: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.194.114
description:
[2025-02-05 15:34:42 +0100] info [webmaild] 177.73.194.114 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  5 15:35:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-05 15:35:45 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:51626: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.245.183
description:
[2025-02-05 15:35:22 +0100] info [webmaild] 45.233.245.183 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  5 15:36:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Feb  5 15:36:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-02-05 15:36:04 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:40953: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Feb  5 15:36:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Feb  5 15:36:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.2
description:
Feb  5 15:36:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
description:
Feb  5 15:36:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
description:
Feb  5 15:36:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
description:
2025-02-05 15:36:20 dovecot_plain authenticator failed for ([116.92.208.12]) [116.92.208.12]:43494: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
description:
2025-02-05 15:36:22 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:59121: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
description:
2025-02-05 15:36:24 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:61496: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-05 15:36:25 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:13270: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-02-05 15:36:36 dovecot_plain authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:43062: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-02-05 15:36:41 dovecot_plain authenticator failed for ([41.216.84.18]) [41.216.84.18]:56465: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Feb  5 15:36:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-02-05 15:36:09 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:53504: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
description:
2025-02-05 15:36:12 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:54305: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.2
description:
2025-02-05 15:36:18 dovecot_plain authenticator failed for ([222.180.2.2]) [222.180.2.2]:59977: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
description:
Feb  5 15:36:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
description:
Feb  5 15:36:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-02-05 15:36:11 dovecot_plain authenticator failed for (subminal) [102.53.15.54]:58607: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-02-05 15:36:13 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:34322: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Feb  5 15:36:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
description:
Feb  5 15:36:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.96.45.84
description:
[2025-02-05 15:36:54 +0100] info [webmaild] 92.96.45.84 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
description:
2025-02-05 15:37:18 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:60564: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
description:
Feb  5 15:37:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-05 15:37:18 dovecot_login authenticator failed for ([116.86.99.64]) [116.86.99.64]:32881: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
description:
Feb  5 15:37:35 ait sshd[634540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
description:
Feb  5 15:37:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
description:
Feb  5 15:37:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
description:
Feb  5 15:37:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  5 15:38:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-02-05 15:37:04 dovecot_login authenticator failed for ([77.235.25.35]) [77.235.25.35]:60973: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.21.218.80
description:
Feb  5 15:37:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.21.218.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.22.238.46
description:
[2025-02-05 15:37:29 +0100] info [webmaild] 186.22.238.46 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 15:37:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
description:
Feb  5 15:37:35 ait sshd[634540]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  5 15:37:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
description:
Feb  5 15:37:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
description:
2025-02-05 15:37:58 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:43873: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.76.195
description:
[2025-02-05 15:37:20 +0100] info [webmaild] 213.230.76.195 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.21.218.80
description:
2025-02-05 15:37:28 dovecot_login authenticator failed for ([89.21.218.80]) [89.21.218.80]:52358: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
description:
2025-02-05 15:37:04 dovecot_login authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:59426: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
description:
2025-02-05 15:37:38 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se (symolie) [83.255.9.170]:37878: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-02-05 15:37:55 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:46751: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Feb  5 15:37:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
description:
2025-02-05 15:37:30 dovecot_login authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:49922: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.69.150.198
description:
[2025-02-05 15:37:53 +0100] info [webmaild] 103.69.150.198 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
description:
Feb  5 15:37:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
description:
2025-02-05 15:38:21 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:60412: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-02-05 15:38:37 dovecot_login authenticator failed for ([218.22.253.37]) [218.22.253.37]:40658: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-02-05 15:38:40 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:35449: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-02-05 15:38:08 dovecot_login authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:57157: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Feb  5 15:38:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Feb  5 15:38:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-02-05 15:38:53 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:40780: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Feb  5 15:38:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
description:
2025-02-05 15:38:09 dovecot_login authenticator failed for ([103.132.199.18]) [103.132.199.18]:62515: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Feb  5 15:38:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-02-05 15:38:24 dovecot_login authenticator failed for ([95.221.238.206]) [95.221.238.206]:56266: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.193.248
description:
2025-02-05 15:38:27 dovecot_login authenticator failed for (248-193-136-45.ddns.movitel.tv) [45.136.193.248]:47708: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.33.207.58
description:
Feb  5 15:38:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.33.207.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-02-05 15:38:44 dovecot_login authenticator failed for ([23.94.179.104]) [23.94.179.104]:44102: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.33.207.58
description:
2025-02-05 15:38:49 dovecot_login authenticator failed for ([121.33.207.58]) [121.33.207.58]:52267: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Feb  5 15:38:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
description:
Feb  5 15:38:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Feb  5 15:38:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
description:
Feb  5 15:38:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Feb  5 15:38:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
description:
Feb  5 15:38:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  5 15:38:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 15:38:41 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:32992: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
description:
Feb  5 15:38:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.136.193.248
description:
Feb  5 15:38:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.136.193.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
description:
2025-02-05 15:38:30 dovecot_plain authenticator failed for ([162.186.17.150]) [162.186.17.150]:53240: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
description:
Feb  5 15:38:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
description:
2025-02-05 15:38:34 dovecot_login authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:55486: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-05 15:38:02 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:51882: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-02-05 15:38:16 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:21854: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
description:
2025-02-05 15:38:16 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:38358: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-02-05 15:38:42 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:60044: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-02-05 15:38:42 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (rofle) [92.244.126.105]:39031: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
description:
2025-02-05 15:38:11 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:55675: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Feb  5 15:38:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-02-05 15:38:15 dovecot_login authenticator failed for ([185.232.39.165]) [185.232.39.165]:59314: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
description:
Feb  5 15:38:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.186.17.150
description:
Feb  5 15:38:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.186.17.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Feb  5 15:38:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-02-05 15:39:22 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:56607: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-02-05 15:39:34 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:38004: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.12.229
description:
Feb  5 15:39:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.12.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 15:39:08 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:40124: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
description:
2025-02-05 15:39:21 dovecot_login authenticator failed for ([1.26.70.70]) [1.26.70.70]:48501: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Feb  5 15:39:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.12.229
description:
2025-02-05 15:39:36 dovecot_login authenticator failed for ([221.162.12.229]) [221.162.12.229]:35649: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Feb  5 15:39:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.57.70.22
description:
Feb  5 15:39:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.57.70.22 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-39.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.237.17
description:
[2025-02-05 15:39:38 +0100] info [webmaild] 190.97.237.17 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.204.146
description:
Feb  5 15:39:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.107.204.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Feb  5 15:39:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-02-05 15:39:04 dovecot_login authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:40937: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 15:39:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
description:
Feb  5 15:39:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-02-05 15:40:24 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:40047: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.248.211.38
description:
Feb  5 15:40:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.248.211.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-02-05 15:40:56 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:42782: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.204.146
description:
Feb  5 15:40:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.107.204.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.224.61
description:
[2025-02-05 15:40:14 +0100] info [webmaild] 45.65.224.61 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Feb  5 15:40:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.168.9
description:
2025-02-05 15:40:31 dovecot_login authenticator failed for ([219.145.168.9]) [219.145.168.9]:32831: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-05 15:40:20 dovecot_login authenticator failed for ([222.103.235.223]) [222.103.235.223]:54750: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Feb  5 15:40:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.144.24
description:
[2025-02-05 15:40:01 +0100] info [webmaild] 37.238.144.24 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.36
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:abubakartankojr@gmail.com||WPU:abubakartankojr@gmail.com||RSV:6.65||T:APACHE||MV:15-40.204.10.194.36


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.165.110.183
description:
[2025-02-05 15:40:33 +0100] info [webmaild] 165.165.110.183 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.248.211.38
description:
2025-02-05 15:40:40 dovecot_plain authenticator failed for ([183.71.251.66]) [113.248.211.38]:45334: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.81.78.32
description:
2025-02-05 15:40:21 dovecot_login authenticator failed for ([185.81.78.32]) [185.81.78.32]:41569: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Feb  5 15:40:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-05 15:40:32 dovecot_login authenticator failed for ([118.70.227.203]) [118.70.227.203]:42703: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  5 15:40:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.81.78.32
description:
Feb  5 15:40:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.81.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  5 15:40:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
description:
Feb  5 15:40:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-02-05 15:40:43 dovecot_login authenticator failed for ([103.68.38.78]) [103.68.38.78]:40280: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-02-05 15:40:29 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it (host-88-43-231-188.business.telecomitalia.it) [88.43.231.186]:47822: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.168.9
description:
Feb  5 15:40:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.168.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.114.36
description:
Feb  5 15:41:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.114.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.114.36
description:
2025-02-05 15:41:17 dovecot_login authenticator failed for ([58.16.114.36]) [58.16.114.36]:48345: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.229.229.174
description:
[2025-02-05 15:42:29 +0100] info [webmaild] 37.229.229.174 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.149.185
description:
Feb  5 15:42:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.149.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  5 15:42:57 ait sshd[636963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
description:
2025-02-05 15:42:59 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:38755: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  5 15:42:27 ait sshd[636701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-02-05 15:42:48 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:55246: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.149.185
description:
2025-02-05 15:42:42 dovecot_plain authenticator failed for ([120.237.149.185]) [120.237.149.185]:30358: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.145.113.24
description:
[2025-02-05 15:42:40 +0100] info [webmaild] 103.145.113.24 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Feb  5 15:42:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  5 15:42:27 ait sshd[636701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
description:
Feb  5 15:42:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  5 15:42:57 ait sshd[636963]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.229.54.138
description:
[2025-02-05 15:43:07 +0100] info [webmaild] 46.229.54.138 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
description:
2025-02-05 15:43:41 dovecot_plain authenticator failed for (expigaroph) [65.20.200.71]:38800: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 15:43:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.120.115.215
description:
[2025-02-05 15:43:03 +0100] info [webmaild] 45.120.115.215 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
description:
Feb  5 15:43:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.140.176.170
description:
Feb  5 15:43:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.140.176.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.140.176.170
description:
2025-02-05 15:43:05 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:44576: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.241.136.85
description:
Feb  5 15:44:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.241.136.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.241.136.85
description:
2025-02-05 15:44:08 dovecot_login authenticator failed for 85.sub-166-241-136.myvzw.com [166.241.136.85]:37242: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
description:
Feb  5 15:44:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
description:
2025-02-05 15:44:21 dovecot_login authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:53540: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Feb  5 15:45:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.253
description:
Feb  5 15:45:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.171.161
description:
2025-02-05 15:45:33 dovecot_plain authenticator failed for ([59.37.171.161]) [59.37.171.161]:53653: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Feb  5 15:45:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  5 15:45:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-05 15:45:52 dovecot_login authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:33442: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  5 15:45:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 15:45:24 dovecot_login authenticator failed for ([179.252.107.105]) [177.6.235.62]:45239: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Feb  5 15:45:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  5 15:45:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-02-05 15:45:12 dovecot_plain authenticator failed for (serical) [62.74.225.186]:38841: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.249.231.169
description:
[2025-02-05 15:45:20 +0100] info [webmaild] 167.249.231.169 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 15:45:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-02-05 15:45:45 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:63697: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-05 15:45:58 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:60479: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Feb  5 15:45:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.253
description:
2025-02-05 15:45:33 dovecot_login authenticator failed for ([27.45.233.253]) [27.45.233.253]:57992: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.33.207.58
description:
Feb  5 15:45:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.33.207.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.33.207.58
description:
2025-02-05 15:45:41 dovecot_login authenticator failed for ([121.33.207.58]) [121.33.207.58]:54338: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.68.25.19
description:
[2025-02-05 15:45:08 +0100] info [webmaild] 154.68.25.19 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-05 15:45:47 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:49746: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.19
description:
Feb  5 15:45:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-02-05 15:45:23 dovecot_login authenticator failed for ([60.247.92.186]) [60.247.92.186]:49383: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-02-05 15:45:35 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:45804: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-02-05 15:45:48 dovecot_login authenticator failed for ([175.208.186.206]) [175.208.186.206]:33468: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.19
description:
2025-02-05 15:45:11 dovecot_login authenticator failed for (ppp19-lumwana.zamnet.zm) [196.46.199.19]:33137: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-02-05 15:45:17 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:38070: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.37.171.161
description:
Feb  5 15:45:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.37.171.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Feb  5 15:45:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.114.55.4
description:
[2025-02-05 15:45:41 +0100] info [webmaild] 185.114.55.4 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.64.205.199
description:
Feb  5 15:45:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.64.205.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-02-05 15:45:53 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:40360: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Feb  5 15:45:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.64.205.199
description:
2025-02-05 15:45:43 dovecot_plain authenticator failed for ([188.64.205.199]) [188.64.205.199]:54535: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Feb  5 15:45:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.54.36
description:
Feb  5 15:46:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.54.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-02-05 15:46:34 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:45792: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
description:
Feb  5 15:46:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-02-05 15:46:22 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:36198: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-02-05 15:46:33 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:60816: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
description:
2025-02-05 15:46:34 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:55445: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.208
description:
Feb  5 15:46:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-02-05 15:46:48 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:41923: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-05 15:46:49 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:57458: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Feb  5 15:46:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.155.188.127
description:
[2025-02-05 15:46:03 +0100] info [webmaild] 160.155.188.127 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Feb  5 15:46:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  5 15:46:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-02-05 15:46:54 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:43379: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
description:
Feb  5 15:46:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  5 15:46:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.180.84
description:
Feb  5 15:46:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Feb  5 15:46:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
description:
2025-02-05 15:46:37 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:41376: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.67.146
description:
2025-02-05 15:46:24 dovecot_plain authenticator failed for ([154.203.67.146]) [154.203.67.146]:36605: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Feb  5 15:46:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
description:
Feb  5 15:46:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
description:
2025-02-05 15:46:23 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:49274: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-02-05 15:46:28 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:38164: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
description:
2025-02-05 15:46:04 dovecot_login authenticator failed for (80-184-100-101.myrepublic.com.sg) [101.100.184.80]:59232: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.208
description:
2025-02-05 15:46:48 dovecot_plain authenticator failed for ([163.179.123.208]) [163.179.123.208]:51366: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-05 15:46:55 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:52202: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  5 15:46:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-02-05 15:46:40 dovecot_plain authenticator failed for (brazully) [62.231.31.86]:34763: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
description:
Feb  5 15:46:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-05 15:46:44 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:51970: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Feb  5 15:46:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
description:
Feb  5 15:46:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.52.253.175
description:
2025-02-05 15:46:29 dovecot_plain authenticator failed for ([111.52.253.175]) [111.52.253.175]:33292: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.187
description:
2025-02-05 15:46:29 dovecot_plain authenticator failed for ([103.146.233.187]) [103.146.233.187]:43870: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.79.249.83
description:
Feb  5 15:46:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.79.249.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
description:
Feb  5 15:46:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Feb  5 15:46:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-02-05 15:46:41 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:41557: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
description:
Feb  5 15:46:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.52.253.175
description:
Feb  5 15:46:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.52.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 15:46:49 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:38728: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.71.106
description:
2025-02-05 15:46:24 dovecot_plain authenticator failed for (abts-kk-static-106.71.166.122.airtelbroadband.in) [122.166.71.106]:57488: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.187
description:
Feb  5 15:46:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Feb  5 15:46:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-05 15:46:46 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:48234: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 15:46:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.203.67.146
description:
Feb  5 15:46:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.203.67.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.71.106
description:
Feb  5 15:46:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
description:
2025-02-05 15:46:25 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:57316: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Feb  5 15:46:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-02-05 15:46:28 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:49695: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
description:
2025-02-05 15:46:34 dovecot_plain authenticator failed for ([60.172.54.36]) [60.172.54.36]:50587: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-02-05 15:46:35 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:37180: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Feb  5 15:46:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Feb  5 15:46:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
description:
2025-02-05 15:46:35 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:46442: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
description:
2025-02-05 15:46:35 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:57872: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.1.159
description:
Feb  5 15:46:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.1.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Feb  5 15:46:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-02-05 15:46:50 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:57150: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
description:
Feb  5 15:46:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.159
description:
2025-02-05 15:46:40 dovecot_plain authenticator failed for 111-70-1-159.emome-ip.hinet.net [111.70.1.159]:39504: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-05 15:46:57 dovecot_login authenticator failed for ([58.216.101.166]) [58.216.101.162]:37646: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-02-05 15:46:29 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:57755: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-02-05 15:46:34 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:33960: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-02-05 15:46:37 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:48547: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
description:
Feb  5 15:46:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
description:
2025-02-05 15:46:45 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:39160: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  5 15:46:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.180.84
description:
2025-02-05 15:46:46 dovecot_plain authenticator failed for ([120.238.180.84]) [120.238.180.84]:33382: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
description:
2025-02-05 15:46:47 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:63252: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Feb  5 15:46:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.210
description:
Feb  5 15:47:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  5 15:46:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
description:
Feb  5 15:46:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
description:
2025-02-05 15:46:31 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:41414: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Feb  5 15:46:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
description:
Feb  5 15:46:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
description:
2025-02-05 15:46:37 dovecot_plain authenticator failed for ([50.79.249.83]) [50.79.249.83]:39321: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-02-05 15:46:23 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:48168: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
description:
Feb  5 15:47:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.123.250
description:
Feb  5 15:47:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.123.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Feb  5 15:47:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.73.75.82
description:
2025-02-05 15:47:08 dovecot_plain authenticator failed for ([212.73.75.82]) [212.73.75.82]:46708: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.233.108
description:
Feb  5 15:47:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.233.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.233.108
description:
2025-02-05 15:47:15 dovecot_plain authenticator failed for bb116-14-233-108.singnet.com.sg [116.14.233.108]:58810: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Feb  5 15:47:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-02-05 15:47:18 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:58232: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-02-05 15:47:26 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:58442: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.120.158.72
description:
[2025-02-05 15:47:41 +0100] info [webmaild] 187.120.158.72 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-02-05 15:47:06 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:50338: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Feb  5 15:47:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.73.75.82
description:
Feb  5 15:47:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.73.75.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.203.122.112
description:
2025-02-05 15:47:15 dovecot_plain authenticator failed for syn-069-203-122-112.res.spectrum.com [69.203.122.112]:57257: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.123.250
description:
2025-02-05 15:47:19 dovecot_login authenticator failed for bb116-14-123-250.singnet.com.sg [116.14.123.250]:48852: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
description:
2025-02-05 15:47:28 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:33207: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
description:
2025-02-05 15:47:02 dovecot_plain authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:34067: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.71.65.15
description:
[2025-02-05 15:48:14 +0100] info [webmaild] 200.71.65.15 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 96.43.175.27
description:
[2025-02-05 15:48:21 +0100] info [webmaild] 96.43.175.27 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Feb  5 15:48:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Feb  5 15:48:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
description:
2025-02-05 15:48:18 dovecot_login authenticator failed for ([179.124.54.6]) [179.124.54.6]:37819: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-02-05 15:48:19 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:44836: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-02-05 15:48:30 dovecot_login authenticator failed for (43-252-8-34.quantum.net.id) [43.252.8.34]:36768: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Feb  5 15:48:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.219.70.114
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:wwwadmin||WPU:wwwadmin||RSV:6.65||T:APACHE||MV:15-48.103.219.70.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.84.15.57
description:
[2025-02-05 15:48:06 +0100] info [webmaild] 95.84.15.57 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
description:
Feb  5 15:48:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-02-05 15:48:34 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:36600: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.217.199.167
description:
Feb  5 15:49:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.217.199.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.217.199.167
description:
2025-02-05 15:49:36 dovecot_login authenticator failed for ([114.217.199.167]) [114.217.199.167]:25931: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Feb  5 15:49:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.115
description:
Feb  5 15:49:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
description:
Feb  5 15:49:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-02-05 15:49:50 dovecot_login authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:51172: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-02-05 15:49:54 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:47801: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Feb  5 15:50:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.115
description:
2025-02-05 15:49:21 dovecot_login authenticator failed for (m121-202-152-115.smartone.com) [121.202.152.115]:3469: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.71.79.189
description:
[2025-02-05 15:50:22 +0100] info [webmaild] 177.71.79.189 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 15:50:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 15:50:29 dovecot_login authenticator failed for ([179.252.107.105]) [177.6.235.62]:44398: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
description:
Feb  5 15:50:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
description:
Feb  5 15:50:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-02-05 15:50:53 dovecot_login authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:54034: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.108
description:
Feb  5 15:50:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.10.136.45
description:
[2025-02-05 15:50:14 +0100] info [webmaild] 190.10.136.45 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.12.44
description:
Feb  5 15:50:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.132.64
description:
[2025-02-05 15:50:47 +0100] info [webmaild] 179.125.132.64 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
description:
2025-02-05 15:50:46 dovecot_login authenticator failed for ([45.165.170.41]) [45.165.170.41]:58818: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.123.171.155
description:
[2025-02-05 15:50:49 +0100] info [webmaild] 94.123.171.155 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-02-05 15:50:07 dovecot_login authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:59985: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.12.44
description:
2025-02-05 15:50:18 dovecot_login authenticator failed for ([5.142.12.44]) [5.142.12.44]:56427: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-05 15:50:39 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:55229: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-02-05 15:50:42 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:49885: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Feb  5 15:50:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
description:
Feb  5 15:50:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-02-05 15:50:57 dovecot_login authenticator failed for ([61.191.163.102]) [61.191.163.102]:40568: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Feb  5 15:50:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Feb  5 15:50:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
description:
2025-02-05 15:50:43 dovecot_login authenticator failed for ([115.42.173.64]) [115.42.173.64]:50382: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.164.173.53
description:
Feb  5 15:50:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.164.173.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.164.173.53
description:
2025-02-05 15:50:51 dovecot_login authenticator failed for ([41.164.173.53]) [41.164.173.53]:42330: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.108
description:
2025-02-05 15:50:14 dovecot_login authenticator failed for ([112.91.124.108]) [112.91.124.108]:40619: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Feb  5 15:50:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-02-05 15:50:39 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:41252: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
description:
2025-02-05 15:50:32 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:37685: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  5 15:50:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Feb  5 15:50:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-02-05 15:50:02 dovecot_login authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:44112: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  5 15:51:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-02-05 15:51:04 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:27235: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Feb  5 15:51:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-02-05 15:51:26 dovecot_login authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:35332: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
description:
Feb  5 15:51:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
description:
2025-02-05 15:51:29 dovecot_login authenticator failed for ([58.18.64.54]) [58.18.64.54]:48339: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Feb  5 15:51:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
description:
2025-02-05 15:51:05 dovecot_login authenticator failed for ([65.20.194.206]) [65.20.194.206]:55244: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.249.163.4
description:
Feb  5 15:51:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.249.163.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Feb  5 15:51:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-02-05 15:51:50 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:44150: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-05 15:51:09 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:3034: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.249.163.4
description:
2025-02-05 15:51:14 dovecot_login authenticator failed for ([162.249.163.4]) [162.249.163.4]:37090: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.97.63.16
description:
Feb  5 15:51:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.97.63.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.63.16
description:
2025-02-05 15:51:38 dovecot_login authenticator failed for ([211.97.63.16]) [211.97.63.16]:60727: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Feb  5 15:51:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
description:
Feb  5 15:51:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-02-05 15:51:05 dovecot_login authenticator failed for ([221.146.201.37]) [221.146.201.37]:43228: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-05 15:51:39 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:60641: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Feb  5 15:52:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-02-05 15:52:55 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:47830: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  5 15:52:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.101.236
description:
Feb  5 15:52:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.101.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  5 15:52:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
description:
2025-02-05 15:52:37 dovecot_login authenticator failed for ([23.237.83.130]) [23.237.83.130]:60236: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-05 15:52:20 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (quitroya) [91.56.31.167]:59507: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.54.57.173
description:
[2025-02-05 15:52:53 +0100] info [webmaild] 38.54.57.173 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Feb  5 15:52:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-05 15:52:15 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:45302: 535 Incorrect authentication data (set_id=cole@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
description:
2025-02-05 15:52:30 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:49444: 535 Incorrect authentication data (set_id=eng20a00070y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.105.182.88
description:
2025-02-05 15:52:54 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:46110: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.101.236
description:
2025-02-05 15:52:18 dovecot_login authenticator failed for 110-25-101-236.adsl.fetnet.net [110.25.101.236]:48847: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
description:
Feb  5 15:52:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
description:
Feb  5 15:52:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.60
description:
Feb  5 15:52:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.107.10.172
description:
Feb  5 15:52:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.107.10.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.18.139.82
description:
Feb  5 15:52:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.18.139.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.60
description:
2025-02-05 15:52:43 dovecot_plain authenticator failed for ([163.179.123.60]) [163.179.123.60]:35292: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-02-05 15:52:45 dovecot_login authenticator failed for ([220.120.227.186]) [220.120.227.186]:45492: 535 Incorrect authentication data (set_id=eng20a00113y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Feb  5 15:52:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.127
description:
2025-02-05 15:52:36 dovecot_login authenticator failed for ([104.241.238.127]) [104.241.238.127]:47480: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.252.115
description:
2025-02-05 15:52:33 dovecot_login authenticator failed for (189-20-254-233.customer.tdatabrasil.net.br) [189.56.252.115]:40695: 535 Incorrect authentication data (set_id=eng20a00113y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.249
description:
Feb  5 15:52:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.107.10.172
description:
2025-02-05 15:52:28 dovecot_login authenticator failed for (mail.frontop.cn) [218.107.10.172]:36978: 535 Incorrect authentication data (set_id=cole)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.89.122.25
description:
Feb  5 15:52:37 ait sshd[641580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.89.122.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-02-05 15:52:50 dovecot_login authenticator failed for ([180.71.9.57]) [180.71.9.57]:47054: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.195.250
description:
2025-02-05 15:53:19 dovecot_plain authenticator failed for (zoracty) [65.20.195.250]:34126: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.141.209.85
description:
[2025-02-05 15:53:05 +0100] info [webmaild] 103.141.209.85 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
description:
2025-02-05 15:53:05 dovecot_plain authenticator failed for ([177.174.0.3]) [177.174.0.3]:45402: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-02-05 15:53:07 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:4043: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.231.219
description:
[2025-02-05 15:53:25 +0100] info [webmaild] 109.107.231.219 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.229.27
description:
[2025-02-05 15:53:25 +0100] info [webmaild] 45.168.229.27 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-53.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.189.211.114
description:
2025-02-05 15:53:09 dovecot_login authenticator failed for ([222.189.211.114]) [222.189.211.114]:42318: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-02-05 15:53:21 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:35135: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-02-05 15:53:21 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:53724: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-02-05 15:54:09 dovecot_plain authenticator failed for (alogilized) [185.113.49.23]:50514: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-02-05 15:54:08 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (stinicree) [51.255.84.180]:57128: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.141.14
description:
[2025-02-05 15:55:32 +0100] info [webmaild] 37.239.141.14 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.236.72.153
description:
[2025-02-05 15:55:46 +0100] info [webmaild] 176.236.72.153 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.74.14.14
description:
[2025-02-05 15:55:59 +0100] info [webmaild] 105.74.14.14 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Feb  5 15:56:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-05 15:56:28 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4080: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-02-05 15:56:35 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:40032: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-02-05 15:56:36 dovecot_login authenticator failed for ([157.245.145.254]) [157.245.145.254]:33302: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
description:
2025-02-05 15:56:59 dovecot_login authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:56025: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.85.19.199
description:
[2025-02-05 15:56:19 +0100] info [webmaild] 187.85.19.199 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Feb  5 15:56:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-02-05 15:56:52 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:58510: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
description:
2025-02-05 15:56:22 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:14104: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-05 15:56:33 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:37875: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-05 15:57:37 dovecot_login authenticator failed for ([112.111.61.232]) [112.111.61.229]:42724: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
description:
2025-02-05 15:57:59 dovecot_login authenticator failed for ([39.109.127.195]) [39.109.127.195]:51578: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.36
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:FOrSakeN||WPU:FOrSakeN||RSV:6.65||T:APACHE||MV:15-57.204.10.194.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
description:
Feb  5 15:57:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.85
description:
2025-02-05 15:57:19 dovecot_login authenticator failed for (m121-202-152-85.smartone.com) [121.202.152.85]:54952: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-02-05 15:57:25 dovecot_login authenticator failed for ([80.233.77.136]) [80.233.77.136]:54776: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
description:
2025-02-05 15:57:06 dovecot_login authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:39370: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
description:
2025-02-05 15:57:14 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:35144: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-05 15:57:20 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.249]:45884: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
description:
2025-02-05 15:57:31 dovecot_plain authenticator failed for ([185.232.37.90]) [185.232.37.90]:48535: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-02-05 15:57:07 dovecot_login authenticator failed for ([60.171.237.143]) [60.171.237.143]:46639: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.85
description:
Feb  5 15:57:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-02-05 15:57:48 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:46090: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.226.119
description:
[2025-02-05 15:58:16 +0100] info [webmaild] 138.59.226.119 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-02-05 15:58:17 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:60605: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-02-05 15:58:41 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:40566: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.168.120
description:
[2025-02-05 15:59:01 +0100] info [webmaild] 45.5.168.120 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.57.233
description:
Feb  5 15:58:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.57.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.18.38
description:
Feb  5 15:58:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.18.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.8
description:
2025-02-05 15:58:02 dovecot_login authenticator failed for ([5.30.225.8]) [5.30.225.8]:44365: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.110.15
description:
[2025-02-05 15:58:26 +0100] info [webmaild] 177.67.110.15 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
description:
2025-02-05 15:58:56 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:47256: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.89.122.25
description:
Feb  5 15:58:58 ait sshd[645137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.89.122.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.57.233
description:
2025-02-05 15:58:13 dovecot_login authenticator failed for (abts-north-static-233.57.160.122.airtelbroadband.in) [122.160.57.233]:36044: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-02-05 15:58:28 dovecot_login authenticator failed for ([147.235.97.158]) [147.235.97.158]:28805: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.3.18.38
description:
2025-02-05 15:58:35 dovecot_login authenticator failed for ([61.3.18.38]) [61.3.18.38]:42310: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.37.222
description:
[2025-02-05 15:58:44 +0100] info [webmaild] 132.255.37.222 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
description:
2025-02-05 15:58:27 dovecot_login authenticator failed for ([175.214.52.214]) [175.214.52.214]:47393: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
description:
2025-02-05 15:59:44 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:36758: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
description:
2025-02-05 15:59:15 dovecot_plain authenticator failed for (119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:37041: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 15:59:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-02-05 16:00:23 dovecot_login authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:51098: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-02-05 16:00:44 dovecot_login authenticator failed for ([121.202.154.250]) [121.202.154.250]:23992: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-02-05 16:00:51 dovecot_login authenticator failed for ([27.125.174.202]) [27.125.174.202]:43145: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.97.42.235
description:
Feb  5 16:00:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.97.42.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
description:
2025-02-05 16:00:11 dovecot_plain authenticator failed for ([45.165.170.41]) [45.165.170.41]:55109: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-02-05 16:00:39 dovecot_login authenticator failed for ([58.51.122.230]) [58.51.122.230]:49176: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.52.34.239
description:
2025-02-05 16:00:46 dovecot_login authenticator failed for ([190.52.34.239]) [190.52.34.239]:58023: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.88.187
description:
2025-02-05 16:00:48 dovecot_login authenticator failed for ([183.236.88.187]) [183.236.88.187]:43656: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.227.41
description:
[2025-02-05 16:00:50 +0100] info [webmaild] 45.181.227.41 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-02-05 16:00:57 dovecot_login authenticator failed for ([187.12.2.110]) [187.12.2.110]:39285: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.255.162
description:
2025-02-05 16:01:00 dovecot_login authenticator failed for p99162-obmd01.tokyo.ocn.ne.jp [124.101.255.162]:39969: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-02-05 16:00:03 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:46285: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-02-05 16:00:24 dovecot_login authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:15537: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-02-05 16:00:36 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:51208: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-02-05 16:00:43 dovecot_login authenticator failed for ([220.120.227.186]) [220.120.227.186]:45502: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.216.86
description:
2025-02-05 16:00:43 dovecot_login authenticator failed for ([61.185.216.86]) [61.185.216.86]:38565: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
description:
2025-02-05 16:00:54 dovecot_login authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:46824: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.74
description:
2025-02-05 16:00:16 dovecot_login authenticator failed for ([183.204.41.74]) [183.204.41.74]:53129: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.193
description:
2025-02-05 16:00:28 dovecot_login authenticator failed for (nsg-corporate-193.227.187.122.airtel.in) [122.187.227.193]:42735: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-02-05 16:00:44 dovecot_login authenticator failed for ([61.160.119.116]) [61.160.119.116]:29815: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.195.142
description:
Feb  5 16:00:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.195.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.170.35.50
description:
2025-02-05 16:00:54 dovecot_login authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:36594: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
description:
Feb  5 16:00:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.27
description:
2025-02-05 16:00:34 dovecot_login authenticator failed for p83028-obmd01.osaka.ocn.ne.jp [180.7.154.27]:58135: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Feb  5 16:00:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
description:
2025-02-05 16:00:45 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:52874: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.105.67.102
description:
2025-02-05 16:00:51 dovecot_login authenticator failed for 67-105-177-102.netprimus.net.br [177.105.67.102]:54714: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
description:
2025-02-05 16:00:53 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:45258: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.74
description:
Feb  5 16:00:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-02-05 16:00:16 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:50488: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.77
description:
2025-02-05 16:00:24 dovecot_login authenticator failed for ([183.204.41.77]) [183.204.41.77]:37502: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
description:
Feb  5 16:00:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-02-05 16:00:43 dovecot_login authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:45491: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.42.235
description:
2025-02-05 16:00:09 dovecot_login authenticator failed for ppp-171-97-42-235.revip8.asianet.co.th [171.97.42.235]:45396: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.25.70
description:
2025-02-05 16:00:23 dovecot_plain authenticator failed for ([39.129.25.70]) [39.129.25.70]:40324: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-02-05 16:00:48 dovecot_login authenticator failed for ([103.180.240.96]) [103.180.240.96]:57282: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.28
description:
Feb  5 16:00:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-02-05 16:00:52 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:37331: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
description:
2025-02-05 16:00:26 dovecot_login authenticator failed for (98.85.179.202.aipl.ankhnet.net) [202.179.85.98]:14341: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.52.34.239
description:
Feb  5 16:00:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.52.34.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-02-05 16:00:33 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:44875: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-02-05 16:00:54 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (hobishly) [109.164.246.53]:43997: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.195.142
description:
2025-02-05 16:00:55 dovecot_login authenticator failed for ([14.49.195.142]) [14.49.195.142]:50431: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-02-05 16:00:19 dovecot_login authenticator failed for ([120.71.199.46]) [120.71.199.46]:34904: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.33.207.58
description:
2025-02-05 16:00:30 dovecot_login authenticator failed for ([121.33.207.58]) [121.33.207.58]:58822: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-02-05 16:01:02 dovecot_login authenticator failed for ([178.35.155.182]) [178.35.155.182]:59801: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.47.42.157
description:
[2025-02-05 16:01:02 +0100] info [webmaild] 177.47.42.157 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-02-05 16:01:25 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:40580: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
description:
2025-02-05 16:01:03 dovecot_login authenticator failed for ([59.1.214.102]) [59.1.214.102]:46706: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-02-05 16:01:08 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:57332: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.89.122.25
description:
Feb  5 16:01:25 ait sshd[646569]: Failed password for invalid user abc from 101.89.122.25 port 42406 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.88.161
description:
Feb  5 16:01:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.88.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.246
description:
2025-02-05 16:01:31 dovecot_login authenticator failed for 111-70-13-246.emome-ip.hinet.net [111.70.13.246]:56724: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.50.178
description:
2025-02-05 16:01:47 dovecot_plain authenticator failed for p157178-obmd01.tokyo.ocn.ne.jp [153.141.50.178]:34487: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.74
description:
Feb  5 16:01:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.88.161
description:
2025-02-05 16:01:28 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.88.161]:49868: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-05 16:01:59 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:54714: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-02-05 16:01:03 dovecot_login authenticator failed for ([75.110.132.232]) [75.110.132.232]:62158: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.74.21
description:
2025-02-05 16:01:16 dovecot_login authenticator failed for ([183.238.74.21]) [183.238.74.21]:34097: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.26.93.14
description:
[2025-02-05 16:01:37 +0100] info [webmaild] 186.26.93.14 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-02-05 16:01:51 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:59254: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.4.204
description:
[2025-02-05 16:01:18 +0100] info [webmaild] 177.11.4.204 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-02-05 16:01:31 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:24892: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-02-05 16:01:03 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:64733: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
description:
2025-02-05 16:01:06 dovecot_login authenticator failed for ([116.228.195.251]) [116.228.195.251]:17948: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.74
description:
2025-02-05 16:01:17 dovecot_login authenticator failed for ([183.204.41.74]) [183.204.41.74]:54081: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-02-05 16:01:01 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:49755: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
description:
2025-02-05 16:01:01 dovecot_login authenticator failed for ([171.227.200.201]) [171.227.200.201]:44954: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.89.122.25
description:
Feb  5 16:01:23 ait sshd[646569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.89.122.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.52.106
description:
2025-02-05 16:02:04 dovecot_plain authenticator failed for ([218.22.52.106]) [218.22.52.106]:33610: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 16:02:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  5 16:02:42 ait sshd[647524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-02-05 16:02:57 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:35145: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-02-05 16:03:11 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:56913: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.179.211
description:
[2025-02-05 16:03:36 +0100] info [webmaild] 138.255.179.211 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.70.124
description:
[2025-02-05 16:03:38 +0100] info [webmaild] 168.232.70.124 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
description:
2025-02-05 16:03:44 dovecot_plain authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:56827: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-02-05 16:03:58 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:52932: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.20
description:
Feb  5 16:04:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.20
description:
2025-02-05 16:04:38 dovecot_plain authenticator failed for (sastaled) [65.20.168.20]:47104: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 16:04:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.248.173.72
description:
[2025-02-05 16:04:03 +0100] info [webmaild] 185.248.173.72 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
description:
2025-02-05 16:04:05 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:51478: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-02-05 16:04:14 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:35836: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
description:
2025-02-05 16:04:52 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:34274: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.135.170.235
description:
[2025-02-05 16:04:12 +0100] info [webmaild] 102.135.170.235 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.26.106
description:
2025-02-05 16:05:12 dovecot_plain authenticator failed for ([58.240.26.106]) [58.240.26.106]:58017: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-02-05 16:05:20 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:53455: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-02-05 16:05:10 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:34528: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.8.168.25
description:
[2025-02-05 16:06:15 +0100] info [webmaild] 201.8.168.25 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.96.207.182
description:
[2025-02-05 16:06:16 +0100] info [webmaild] 179.96.207.182 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
description:
2025-02-05 16:06:37 dovecot_login authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:50000: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.34.99.182
description:
[2025-02-05 16:06:46 +0100] info [webmaild] 194.34.99.182 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 139.5.132.60
description:
[2025-02-05 16:06:48 +0100] info [webmaild] 139.5.132.60 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
description:
2025-02-05 16:06:47 dovecot_login authenticator failed for ([103.59.134.177]) [103.59.134.177]:11380: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
description:
2025-02-05 16:07:52 dovecot_plain authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:65489: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.232.31
description:
Feb  5 16:07:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.232.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.232.31
description:
2025-02-05 16:07:37 dovecot_plain authenticator failed for ([183.245.232.31]) [183.245.232.31]:32796: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.155.27.128
description:
Feb  5 16:07:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.155.27.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Feb  5 16:07:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.106.51
description:
Feb  5 16:07:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.106.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
description:
2025-02-05 16:07:47 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:57966: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-02-05 16:08:00 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:55382: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.157.8
description:
[2025-02-05 16:08:49 +0100] info [webmaild] 45.6.157.8 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-08.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.230.179
description:
[2025-02-05 16:09:23 +0100] info [webmaild] 38.156.230.179 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-02-05 16:09:36 dovecot_plain authenticator failed for (winrhabbly) [65.20.160.195]:58279: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-02-05 16:09:47 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:55846: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-02-05 16:09:21 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:52984: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-05 16:09:23 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:41950: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-02-05 16:09:37 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:49200: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-02-05 16:09:53 dovecot_plain authenticator failed for (regas) [65.20.194.40]:33487: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
description:
2025-02-05 16:09:25 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:48675: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.189.234.37
description:
2025-02-05 16:09:42 dovecot_plain authenticator failed for (ip103-189-234-37.cloudhost.web.id) [103.189.234.37]:54314: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-05 16:09:02 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:56515: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.90.21.148
description:
[2025-02-05 16:09:06 +0100] info [webmaild] 168.90.21.148 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-02-05 16:09:35 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:33095: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.54.235
description:
[2025-02-05 16:09:36 +0100] info [webmaild] 179.125.54.235 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-05 16:10:08 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:52985: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.46.227
description:
47.128.46.227 - - [05/Feb/2025:16:10:14 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15935538 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?duration=extraLong&filter_course-category=61&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
description:
2025-02-05 16:10:18 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:46244: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.117.84
description:
47.128.117.84 - - [05/Feb/2025:16:10:37 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9969832 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?filtering=1&instructor=2&level=beginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.117.84


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Feb  5 16:11:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-02-05 16:11:37 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:58898: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.5.33
description:
[2025-02-05 16:11:54 +0100] info [webmaild] 177.86.5.33 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.179.31.74
description:
[2025-02-05 16:11:57 +0100] info [webmaild] 185.179.31.74 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-02-05 16:11:24 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:53086: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Feb  5 16:11:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.23.28.107
description:
[2025-02-05 16:11:23 +0100] info [webmaild] 186.23.28.107 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.230
description:
[2025-02-05 16:12:52 +0100] info [cpaneld] 156.228.118.230 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.13
description:
[2025-02-05 16:12:59 +0100] info [cpaneld] 104.207.39.13 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 16:12:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.241.177
description:
Feb  5 16:12:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.241.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.52
description:
[2025-02-05 16:12:52 +0100] info [cpaneld] 156.228.118.52 - abs1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Feb  5 16:12:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
description:
2025-02-05 16:12:44 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:41986: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.141.223.15
description:
[2025-02-05 16:12:25 +0100] info [webmaild] 192.141.223.15 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-02-05 16:12:49 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:37970: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 16:14:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.137.56.216
description:
Feb  5 16:13:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.137.56.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.193.129.70
description:
[2025-02-05 16:14:07 +0100] info [webmaild] 186.193.129.70 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
description:
Feb  5 16:13:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Feb  5 16:14:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-02-05 16:14:05 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:39326: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.52.31.132
description:
[2025-02-05 16:14:31 +0100] info [webmaild] 200.52.31.132 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.187.126.130
description:
Feb  5 16:14:11 ait sshd[654138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.187.126.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 16:14:18 ait sshd[654311]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
description:
2025-02-05 16:13:54 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:54285: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
description:
Feb  5 16:14:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  5 16:14:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.187.126.130
description:
Feb  5 16:14:11 ait sshd[654138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.187.126.130  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 16:14:18 ait sshd[654311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.56.216
description:
2025-02-05 16:13:47 dovecot_plain authenticator failed for ([185.137.56.216]) [185.137.56.216]:59794: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.83.205
description:
Feb  5 16:15:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 204.199.152.244
description:
[2025-02-05 16:14:43 +0100] info [webmaild] 204.199.152.244 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.18.252.107
description:
2025-02-05 16:15:11 dovecot_plain authenticator failed for ([14.18.252.107]) [14.18.252.107]:60333: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Feb  5 16:14:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-02-05 16:14:43 dovecot_plain authenticator failed for (tureae) [77.51.214.170]:55495: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.81.86.188
description:
[2025-02-05 16:15:08 +0100] info [webmaild] 185.81.86.188 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 16:15:33 ait sshd[655142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  5 16:14:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.61.63.153
description:
Feb  5 16:14:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.61.63.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.18.252.107
description:
Feb  5 16:15:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.18.252.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Feb  5 16:15:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-02-05 16:15:29 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:38558: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 16:15:33 ait sshd[655142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Feb  5 16:14:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Feb  5 16:15:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-02-05 16:16:01 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:59238: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-02-05 16:16:33 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:63021: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.90.128.6
description:
[2025-02-05 16:16:07 +0100] info [cpaneld] 128.90.128.6 - lemsas "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 16:16:11 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:61988: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.97.90.143
description:
2025-02-05 16:16:12 dovecot_plain authenticator failed for ([180.97.90.143]) [180.97.90.143]:53593: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Feb  5 16:16:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
description:
Feb  5 16:16:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 16:16:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.97.90.143
description:
Feb  5 16:16:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.97.90.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-02-05 16:16:15 dovecot_plain authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:55066: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Feb  5 16:16:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-05 16:16:30 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:55542: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
description:
2025-02-05 16:16:47 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:57012: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.53.6
description:
[2025-02-05 16:16:48 +0100] info [webmaild] 170.239.53.6 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 16:17:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.195.250
description:
Feb  5 16:17:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.195.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.43.217.63
description:
[2025-02-05 16:17:14 +0100] info [webmaild] 181.43.217.63 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
description:
Feb  5 16:16:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.158.41
description:
[2025-02-05 16:17:19 +0100] info [webmaild] 37.238.158.41 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Feb  5 16:17:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.45.225.98
description:
2025-02-05 16:18:35 dovecot_plain authenticator failed for ([69.45.225.98]) [69.45.225.98]:60748: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 16:17:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.137.160.10
description:
[2025-02-05 16:17:47 +0100] info [webmaild] 103.137.160.10 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 16:18:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.45.225.98
description:
Feb  5 16:18:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.45.225.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 16:18:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-05 16:19:05 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:1463: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.249.82
description:
[2025-02-05 16:19:12 +0100] info [webmaild] 168.228.249.82 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
description:
Feb  5 16:18:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 16:18:50 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:1744: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  5 16:19:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-02-05 16:18:48 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:65269: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.192.194.66
description:
Feb  5 16:20:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.192.194.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Feb  5 16:20:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-02-05 16:20:37 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:52363: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.252.138.240
description:
[2025-02-05 16:19:51 +0100] info [webmaild] 38.252.138.240 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.99.188.230
description:
[2025-02-05 16:20:15 +0100] info [webmaild] 78.99.188.230 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.192.194.66
description:
2025-02-05 16:20:24 dovecot_plain authenticator failed for ([14.192.194.66]) [14.192.194.66]:48959: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.162.209.183
description:
[2025-02-05 16:19:44 +0100] info [webmaild] 103.162.209.183 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 47.114.165.248
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-20.47.114.165.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Feb  5 16:21:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.164
description:
Feb  5 16:21:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 16:21:22 ait sshd[658294]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 16:21:22 ait sshd[658294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.87.170
description:
Feb  5 16:22:03 ait sshd[658639]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.87.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.87.170
description:
Feb  5 16:22:03 ait sshd[658639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.87.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.220.206.106
description:
[2025-02-05 16:22:27 +0100] info [webmaild] 103.220.206.106 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Feb  5 16:22:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-02-05 16:22:37 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:56636: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Feb  5 16:21:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.164
description:
Feb  5 16:21:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
description:
Feb  5 16:22:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.170.35.50
description:
Feb  5 16:22:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.170.35.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.87.212.139
description:
[2025-02-05 16:21:54 +0100] info [webmaild] 103.87.212.139 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.170.35.50
description:
2025-02-05 16:22:23 dovecot_plain authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:53210: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-05 16:21:43 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:34599: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
description:
2025-02-05 16:22:08 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:45180: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.4.3
description:
[2025-02-05 16:22:21 +0100] info [webmaild] 37.236.4.3 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.12.8.233
description:
[2025-02-05 16:22:53 +0100] info [webmaild] 186.12.8.233 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-23.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  5 16:23:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-05 16:23:19 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (trist) [91.56.31.167]:64486: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 16:24:35 ait sshd[659835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.90.57.44
description:
[2025-02-05 16:24:30 +0100] info [webmaild] 168.90.57.44 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 16:24:35 ait sshd[659835]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.96.91.71
description:
2025-02-05 16:23:57 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:48812: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Feb  5 16:24:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-02-05 16:24:09 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:52962: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Feb  5 16:24:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-05 16:24:12 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:48764: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Feb  5 16:24:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.165.244.225
description:
Feb  5 16:23:51 ait sshd[659501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.165.244.225


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.91.71
description:
Feb  5 16:23:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.96.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-02-05 16:24:38 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:51810: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  5 16:24:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-02-05 16:24:31 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (unala) [89.153.62.100]:41022: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-02-05 16:25:27 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:34982: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-02-05 16:25:38 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:41032: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-02-05 16:24:52 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:56066: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 16:25:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Feb  5 16:25:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-02-05 16:25:18 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:35073: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Feb  5 16:24:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  5 16:24:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Feb  5 16:24:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


