# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
country_id: 6252001
description:
2025-02-07 06:52:15 dovecot_plain authenticator failed for ([92.118.235.228]) [92.118.235.228]:55040: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
country_id: 1831722
description:
Feb  7 06:51:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-52.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
country_id: 2017370
description:
Feb  7 06:51:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
country_id: 2017370
description:
2025-02-07 06:51:40 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:56904: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  7 06:51:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-07 06:52:05 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:59043: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-02-07 06:52:18 dovecot_login authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:51423: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
country_id: 1819730
description:
2025-02-07 06:52:21 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:38299: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
country_id: 1269750
description:
2025-02-07 06:51:39 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:36798: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
country_id: 99237
description:
Feb  7 06:51:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-02-07 06:51:53 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:35409: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
country_id: 2510769
description:
Feb  7 06:51:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
country_id: 2017370
description:
2025-02-07 06:52:07 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:49290: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.188.117
country_id: 294640
description:
Feb  7 06:51:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.188.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
country_id: 2017370
description:
2025-02-07 06:52:22 dovecot_plain authenticator failed for ([5.189.118.24]) [5.189.118.24]:56932: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  7 06:52:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
country_id: 6252001
description:
Feb  7 06:52:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-07 06:51:42 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:39564: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-02-07 06:51:53 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:48337: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-02-07 06:51:57 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:33003: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Feb  7 06:52:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
country_id: 1819730
description:
Feb  7 06:52:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
country_id: 272103
description:
Feb  7 06:52:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
country_id: 1835841
description:
Feb  7 06:53:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
country_id: 1819730
description:
Feb  7 06:53:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
country_id: 99237
description:
Feb  7 06:53:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
country_id: 1835841
description:
2025-02-07 06:53:06 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:37042: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-02-07 06:53:02 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:50969: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
country_id: 2017370
description:
2025-02-07 06:53:05 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:22842: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
country_id: 3996063
description:
2025-02-07 06:53:15 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:52217: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.216
country_id: 3865483
description:
2025-02-07 06:53:16 dovecot_plain authenticator failed for (201-234-106-216.static.impsat.net.ar) [201.234.106.216]:40815: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
country_id: 1814991
description:
2025-02-07 06:53:17 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:40020: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 06:53:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:13457: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-02-07 06:53:03 dovecot_plain authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:38204: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
country_id: 690791
description:
Feb  7 06:53:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
country_id: 732800
description:
Feb  7 06:52:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
country_id: 1835841
description:
Feb  7 06:53:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 06:53:13 dovecot_plain authenticator failed for ([27.223.100.91]) [27.223.100.90]:39096: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
country_id: 1835841
description:
2025-02-07 06:53:08 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:48694: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
country_id: 1835841
description:
2025-02-07 06:52:38 dovecot_login authenticator failed for ([14.45.217.249]) [14.45.217.249]:45834: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
country_id: 1819730
description:
2025-02-07 06:53:04 dovecot_plain authenticator failed for ([121.202.205.222]) [121.202.205.222]:34785: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.37.54
country_id: 1819730
description:
2025-02-07 06:53:05 dovecot_plain authenticator failed for 054.37.246.220.static.netvigator.com [220.246.37.54]:55457: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.34.107
country_id: 1835841
description:
2025-02-07 06:53:06 dovecot_plain authenticator failed for ([112.184.34.107]) [112.184.34.107]:58352: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
country_id: 1036973
description:
Feb  7 06:53:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
country_id: 1814991
description:
2025-02-07 06:52:30 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:43342: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.244.113.178
country_id: 2017370
description:
Feb  7 06:53:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.244.113.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
country_id: 2017370
description:
2025-02-07 06:53:04 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:60310: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
country_id: 6252001
description:
Feb  7 06:53:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  7 06:53:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-02-07 06:53:10 dovecot_plain authenticator failed for ([119.155.143.242]) [182.176.4.105]:59211: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
country_id: 1819730
description:
2025-02-07 06:53:11 dovecot_plain authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:49162: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
country_id: 6252001
description:
Feb  7 06:53:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-07 06:52:33 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:35328: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-02-07 06:53:14 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:40169: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
country_id: 690791
description:
2025-02-07 06:53:02 dovecot_login authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:34922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.4.105
country_id: 1168579
description:
Feb  7 06:53:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.4.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
country_id: 1835841
description:
2025-02-07 06:53:12 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:53632: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
country_id: 99237
description:
2025-02-07 06:53:16 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:42549: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
country_id: 690791
description:
2025-02-07 06:53:17 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:33231: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
country_id: 933860
description:
Feb  7 06:53:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-02-07 06:53:20 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:60729: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
country_id: 1835841
description:
Feb  7 06:52:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
country_id: 1814991
description:
Feb  7 06:52:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-07 06:52:59 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:47860: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.121
country_id: 2661886
description:
2025-02-07 06:53:00 dovecot_plain authenticator failed for h-46-59-90-121.a463.priv.bahnhof.se [46.59.90.121]:52094: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
country_id: 294640
description:
Feb  7 06:53:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
country_id: 1814991
description:
Feb  7 06:53:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-02-07 06:53:02 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:46538: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
country_id: 1835841
description:
Feb  7 06:53:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
country_id: 272103
description:
2025-02-07 06:52:23 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:49698: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.86.146.178
country_id: 1814991
description:
Feb  7 06:53:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.86.146.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-02-07 06:53:06 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:33752: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-07 06:52:33 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:37845: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.44.7
country_id: 3469034
description:
[2025-02-07 06:52:36 +0100] info [webmaild] 45.238.44.7 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 06:52:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.59.90.121
country_id: 2661886
description:
Feb  7 06:52:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.59.90.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
country_id: 3469034
description:
2025-02-07 06:53:02 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:53008: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.37.54
country_id: 1819730
description:
Feb  7 06:53:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.37.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
country_id: 1835841
description:
Feb  7 06:53:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  7 06:52:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
country_id: 1814991
description:
Feb  7 06:53:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
country_id: 6252001
description:
2025-02-07 06:53:10 dovecot_login authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:63750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
country_id: 2017370
description:
Feb  7 06:53:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
country_id: 6252001
description:
Feb  7 06:53:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
country_id: 6252001
description:
2025-02-07 06:53:16 dovecot_login authenticator failed for ([92.118.235.228]) [92.118.235.228]:35310: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.101.131.83
country_id: 2017370
description:
Feb  7 06:53:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.101.131.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
country_id: 337996
description:
2025-02-07 06:53:19 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:49040: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
country_id: 3469034
description:
Feb  7 06:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
country_id: 1814991
description:
Feb  7 06:52:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.34.107
country_id: 1835841
description:
Feb  7 06:53:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.34.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-02-07 06:53:06 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:41098: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
country_id: 2245662
description:
Feb  7 06:53:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-02-07 06:53:18 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:55725: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
country_id: 2245662
description:
2025-02-07 06:53:18 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:35512: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  7 06:52:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.35.18
country_id: 1814991
description:
Feb  7 06:52:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.35.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
country_id: 1814991
description:
2025-02-07 06:52:54 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:38716: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
country_id: 102358
description:
Feb  7 06:52:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
country_id: 690791
description:
Feb  7 06:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
country_id: 1819730
description:
Feb  7 06:53:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
country_id: 2017370
description:
2025-02-07 06:53:03 dovecot_login authenticator failed for (91.244.113.178.wirenet.tv) [91.244.113.178]:47714: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-02-07 06:53:09 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:56183: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
country_id: 1814991
description:
2025-02-07 06:52:44 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:50774: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.101.131.83
country_id: 2017370
description:
2025-02-07 06:53:19 dovecot_plain authenticator failed for ([92.101.131.83]) [92.101.131.83]:46432: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
country_id: 2017370
description:
Feb  7 06:53:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-07 06:53:12 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:59537: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.216
country_id: 3865483
description:
Feb  7 06:53:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  7 06:53:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
country_id: 6252001
description:
Feb  7 06:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
country_id: 294640
description:
2025-02-07 06:53:14 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:53689: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.86.146.178
country_id: 1814991
description:
2025-02-07 06:53:19 dovecot_plain authenticator failed for ([112.86.146.178]) [112.86.146.178]:58661: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
country_id: 3469034
description:
Feb  7 06:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
country_id: 2510769
description:
Feb  7 06:53:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-02-07 06:53:04 dovecot_plain authenticator failed for ([122.187.227.144]) [122.187.227.144]:45780: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
country_id: 1643084
description:
Feb  7 06:53:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 06:53:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.64.191
country_id: 294640
description:
Feb  7 06:53:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.64.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
country_id: 3996063
description:
Feb  7 06:53:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
country_id: 337996
description:
Feb  7 06:53:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.144
country_id: 1269750
description:
Feb  7 06:53:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
country_id: 1814991
description:
2025-02-07 06:53:04 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:55201: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
country_id: 732800
description:
2025-02-07 06:52:59 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:28362: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
country_id: 298795
description:
Feb  7 06:53:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
country_id: 1835841
description:
2025-02-07 06:53:26 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:57494: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  7 06:53:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 3.25.51.205
country_id: 2077456
description:
[2025-02-07 06:53:31 +0100] info [webmaild] 3.25.51.205 - ads19a00020y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user ads19a00020y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
country_id: 1668284
description:
Feb  7 06:53:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.56.111.87
country_id: 1814991
description:
Feb  7 06:53:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.56.111.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
country_id: 2661886
description:
2025-02-07 06:54:14 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:57958: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
country_id: 3469034
description:
2025-02-07 06:54:17 dovecot_login authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:58848: 535 Incorrect authentication data (set_id=iric@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.151.142.219
country_id: 2661886
description:
2025-02-07 06:53:52 dovecot_plain authenticator failed for c188-151-142-219.bredband.tele2.se (aullathal) [188.151.142.219]:55414: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
country_id: 1814991
description:
Feb  7 06:53:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.145.252.2
country_id: 690791
description:
2025-02-07 06:53:27 dovecot_plain authenticator failed for ([91.145.252.2]) [91.145.252.2]:55032: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
country_id: 1814991
description:
2025-02-07 06:53:32 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:49319: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
country_id: 6252001
description:
Feb  7 06:53:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-02-07 06:53:43 dovecot_plain authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:50508: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.151.142.219
country_id: 2661886
description:
Feb  7 06:53:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.151.142.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
country_id: 1835841
description:
2025-02-07 06:53:27 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:39401: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
country_id: 597427
description:
Feb  7 06:53:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 06:53:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Feb  7 06:54:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.161
country_id: 1814991
description:
2025-02-07 06:54:10 dovecot_login authenticator failed for ([112.102.48.161]) [112.102.48.161]:35354: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
country_id: 1269750
description:
Feb  7 06:53:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
country_id: 1835841
description:
Feb  7 06:53:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
country_id: 1835841
description:
Feb  7 06:53:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
country_id: 1814991
description:
Feb  7 06:53:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
country_id: 6252001
description:
2025-02-07 06:53:35 dovecot_plain authenticator failed for ([92.118.235.228]) [92.118.235.228]:33898: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.76.191.29
country_id: 1819730
description:
Feb  7 06:53:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.76.191.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.145.252.2
country_id: 690791
description:
Feb  7 06:53:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.145.252.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
country_id: 298795
description:
2025-02-07 06:53:27 dovecot_login authenticator failed for (95.0.252.78.static.ttnet.com.tr) [95.0.252.78]:33572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
country_id: 3469034
description:
Feb  7 06:54:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
country_id: 1269750
description:
2025-02-07 06:53:24 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:43770: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
country_id: 1814991
description:
2025-02-07 06:53:26 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:57138: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2025-02-07 06:53:46 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:40538: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.161
country_id: 1814991
description:
Feb  7 06:54:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-07 06:53:24 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:44471: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-07 06:53:32 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:35718: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
country_id: 597427
description:
2025-02-07 06:53:44 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:59240: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.56.111.87
country_id: 1814991
description:
2025-02-07 06:53:49 dovecot_login authenticator failed for ([106.56.111.87]) [106.56.111.87]:48670: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
country_id: 2661886
description:
Feb  7 06:54:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.35.82
country_id: 3469034
description:
[2025-02-07 06:54:22 +0100] info [webmaild] 45.185.35.82 - info@ijari.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
country_id: 6252001
description:
2025-02-07 06:55:07 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:43537: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
country_id: 1835841
description:
Feb  7 06:54:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.242.210
country_id: 2017370
description:
Feb  7 06:54:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.242.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
country_id: 3017382
description:
Feb  7 06:54:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.246.134
country_id: 1861060
description:
Feb  7 06:55:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.246.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  7 06:55:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-07 06:54:34 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:45390: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  7 06:54:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-07 06:54:56 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:52170: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.219.254
country_id: 1814991
description:
Feb  7 06:55:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.219.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.219.254
country_id: 1814991
description:
2025-02-07 06:55:05 dovecot_plain authenticator failed for ([124.115.219.254]) [124.115.219.254]:51817: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-02-07 06:54:24 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:50862: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.178.198.136
country_id: 1814991
description:
2025-02-07 06:54:28 dovecot_login authenticator failed for ([117.178.198.136]) [117.178.198.136]:59724: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
country_id: 1814991
description:
2025-02-07 06:54:49 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:42688: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-07 06:55:09 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:1886: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.178.198.136
country_id: 1814991
description:
Feb  7 06:54:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.178.198.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.151.242.210
country_id: 2017370
description:
2025-02-07 06:54:39 dovecot_plain authenticator failed for ([46.151.242.210]) [46.151.242.210]:46502: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-02-07 06:54:42 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:37756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
country_id: 1814991
description:
2025-02-07 06:55:04 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:53413: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.105.139
country_id: 6252001
description:
2025-02-07 06:54:43 dovecot_login authenticator failed for host139.sub-63-46-105.myvzw.com [63.46.105.139]:59654: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
country_id: 1814991
description:
Feb  7 06:54:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2025-02-07 06:54:58 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:34882: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
country_id: 1835841
description:
Feb  7 06:54:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.246.134
country_id: 1861060
description:
2025-02-07 06:55:14 dovecot_plain authenticator failed for st6534.mas4401.y-tokyo.nttpc.ne.jp [160.248.246.134]:36158: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
country_id: 1814991
description:
Feb  7 06:55:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  7 06:55:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Feb  7 06:54:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.105.139
country_id: 6252001
description:
Feb  7 06:54:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.105.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
country_id: 3017382
description:
2025-02-07 06:54:43 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:55396: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
country_id: 1835841
description:
2025-02-07 06:55:49 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:33340: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Feb  7 06:55:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.252.218
country_id: 1814991
description:
Feb  7 06:55:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.252.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2025-02-07 06:55:58 dovecot_plain authenticator failed for ([177.159.150.111]) [177.159.150.111]:39602: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-07 06:55:24 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:32824: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
country_id: 1835841
description:
Feb  7 06:55:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
country_id: 1643084
description:
Feb  7 06:55:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-02-07 06:56:09 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:32993: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  7 06:55:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  7 06:55:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
country_id: 3996063
description:
Feb  7 06:56:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
country_id: 1880251
description:
Feb  7 06:55:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-07 06:55:51 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:53534: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.252.218
country_id: 1814991
description:
2025-02-07 06:55:59 dovecot_plain authenticator failed for ([220.189.252.218]) [220.189.252.218]:55594: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
country_id: 1668284
description:
2025-02-07 06:55:37 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:35041: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
country_id: 1835841
description:
2025-02-07 06:55:40 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:58372: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-07 06:55:46 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:56315: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
country_id: 1880251
description:
2025-02-07 06:55:32 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:48644: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
country_id: 1668284
description:
Feb  7 06:55:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-07 06:55:36 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:36592: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
country_id: 1835841
description:
Feb  7 06:55:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 06:56:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
country_id: 6252001
description:
2025-02-07 06:56:55 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:47472: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.198.31
country_id: 1814991
description:
Feb  7 06:57:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.198.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.196.131
country_id: 1814991
description:
Feb  7 06:57:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.196.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.196.131
country_id: 1814991
description:
2025-02-07 06:57:18 dovecot_login authenticator failed for ([120.82.196.131]) [120.82.196.131]:52026: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.8.21
country_id: 2661886
description:
Feb  7 06:56:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.246.8.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
country_id: 6252001
description:
Feb  7 06:56:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-02-07 06:57:04 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:57054: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
country_id: 1819730
description:
2025-02-07 06:57:07 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:18804: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
country_id: 1814991
description:
2025-02-07 06:57:18 dovecot_login authenticator failed for ([183.167.198.31]) [183.167.198.31]:47802: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Feb  7 06:57:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
country_id: 1819730
description:
Feb  7 06:57:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.21
country_id: 2661886
description:
2025-02-07 06:56:44 dovecot_login authenticator failed for (ADMIN) [46.246.8.21]:53986: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.114.101
country_id: 1168579
description:
Feb  7 06:57:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.114.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
country_id: 1835841
description:
Feb  7 06:57:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
country_id: 1835841
description:
2025-02-07 06:57:53 dovecot_login authenticator failed for ([211.172.79.206]) [211.172.79.206]:44824: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.203.9
country_id: 1835841
description:
Feb  7 06:58:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.203.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.63.79.225
country_id: 3469034
description:
[2025-02-07 06:57:25 +0100] info [webmaild] 179.63.79.225 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
country_id: 1880251
description:
Feb  7 06:57:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
country_id: 3469034
description:
Feb  7 06:57:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
country_id: 3469034
description:
2025-02-07 06:57:34 dovecot_login authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:46700: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.203.9
country_id: 1835841
description:
2025-02-07 06:58:06 dovecot_login authenticator failed for ([121.188.203.9]) [121.188.203.9]:43640: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.124
country_id: 357994
description:
2025-02-07 06:57:27 dovecot_login authenticator failed for (ADMIN) [188.214.122.124]:39530: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.114.101
country_id: 1168579
description:
2025-02-07 06:57:49 dovecot_login authenticator failed for ([119.160.114.101]) [119.160.114.101]:58052: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
country_id: 1880251
description:
2025-02-07 06:57:34 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:4695: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
country_id: 6251999
description:
2025-02-07 06:57:46 dovecot_login authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:36750: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.214.122.124
country_id: 357994
description:
Feb  7 06:57:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.214.122.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
country_id: 6251999
description:
Feb  7 06:57:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 06:58:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.136.139.200
country_id: 1814991
description:
Feb  7 06:59:00 ait sshd[1641589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.136.139.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.136.139.200
country_id: 1814991
description:
Feb  7 06:59:00 ait sshd[1641589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.139.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.137.26
country_id: 1814991
description:
Feb  7 06:59:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
country_id: 1819730
description:
2025-02-07 06:59:59 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:51471: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-07 07:00:06 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:51919: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
country_id: 6252001
description:
Feb  7 06:59:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Feb  7 07:00:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.228.242
country_id: 1814991
description:
2025-02-07 07:00:16 dovecot_plain authenticator failed for ([39.185.228.242]) [39.185.228.242]:54728: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
country_id: 2017370
description:
2025-02-07 06:59:56 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:49314: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
country_id: 1819730
description:
Feb  7 06:59:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.136.139.200
country_id: 1814991
description:
Feb  7 06:59:52 ait sshd[1641907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.136.139.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.86.114.43
country_id: 3469034
description:
2025-02-07 07:00:07 dovecot_plain authenticator failed for (colegioarnaldo241.static.host.gvt.net.br) [201.86.114.43]:36148: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  7 07:00:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.136.139.200
country_id: 1814991
description:
Feb  7 06:59:52 ait sshd[1641907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.139.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.137.26
country_id: 1814991
description:
2025-02-07 06:59:59 dovecot_plain authenticator failed for ([61.185.137.26]) [61.185.137.26]:60105: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
country_id: 1861060
description:
Feb  7 07:00:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
country_id: 6252001
description:
2025-02-07 06:59:55 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:37992: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
country_id: 1880251
description:
Feb  7 07:00:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
country_id: 6252001
description:
2025-02-07 07:00:21 dovecot_login authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:48332: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
country_id: 6252001
description:
Feb  7 06:59:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
country_id: 2017370
description:
2025-02-07 07:00:09 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:49494: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
country_id: 1835841
description:
Feb  7 07:00:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  7 06:59:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2025-02-07 07:00:10 dovecot_plain authenticator failed for ([177.159.150.111]) [177.159.150.111]:50631: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
country_id: 1835841
description:
Feb  7 07:00:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-07 07:00:02 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:58742: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
country_id: 1562822
description:
Feb  7 07:00:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
country_id: 1835841
description:
2025-02-07 07:00:15 dovecot_login authenticator failed for ([175.117.144.158]) [175.117.144.158]:36940: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
country_id: 1835841
description:
2025-02-07 07:00:16 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:59282: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
country_id: 6252001
description:
Feb  7 07:00:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
country_id: 1814991
description:
Feb  7 06:59:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
country_id: 6252001
description:
2025-02-07 07:00:00 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:50554: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
country_id: 1814991
description:
Feb  7 07:00:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-07 07:00:16 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:34676: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
country_id: 1835841
description:
Feb  7 07:00:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
country_id: 6252001
description:
Feb  7 06:59:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.107.148
country_id: 1814991
description:
2025-02-07 07:00:00 dovecot_plain authenticator failed for ([183.237.107.148]) [183.237.107.148]:53290: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
country_id: 1819730
description:
Feb  7 06:59:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
country_id: 6252001
description:
2025-02-07 06:59:54 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:56683: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-02-07 06:59:57 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:48079: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  7 07:00:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.213.107
country_id: 1814991
description:
2025-02-07 07:00:06 dovecot_plain authenticator failed for ([183.237.213.107]) [183.237.213.107]:46435: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 06:59:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-07 06:59:55 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:35885: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.55.59
country_id: 1835841
description:
2025-02-07 06:59:44 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:56246: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.228.242
country_id: 1814991
description:
Feb  7 07:00:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.228.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
country_id: 1880251
description:
2025-02-07 07:00:18 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:1838: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
country_id: 1819730
description:
2025-02-07 06:59:53 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:29378: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
country_id: 2017370
description:
Feb  7 06:59:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.107.148
country_id: 1814991
description:
Feb  7 06:59:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.107.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-02-07 07:00:03 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:54470: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
country_id: 2017370
description:
Feb  7 07:00:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-02-07 07:00:12 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:54932: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
country_id: 1835841
description:
Feb  7 07:00:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
country_id: 1835841
description:
2025-02-07 07:00:18 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:59590: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.55.59
country_id: 1835841
description:
Feb  7 06:59:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.55.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
country_id: 1814991
description:
2025-02-07 07:00:10 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:39576: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  7 07:00:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 07:00:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
country_id: 3469034
description:
Feb  7 07:00:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-02-07 07:00:48 dovecot_login authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:54710: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-07 07:01:11 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:12115: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
country_id: 2245662
description:
Feb  7 07:01:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
country_id: 2510769
description:
Feb  7 07:01:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2025-02-07 07:00:26 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:41618: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
country_id: 3469034
description:
2025-02-07 07:00:41 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:37832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-07 07:01:12 dovecot_login authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:52447: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-02-07 07:00:32 dovecot_plain authenticator failed for ([38.148.95.217]) [38.148.95.217]:32899: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
country_id: 690791
description:
Feb  7 07:00:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Feb  7 07:00:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
country_id: 2245662
description:
2025-02-07 07:01:16 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.50]:34648: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.35
country_id: 2395170
description:
Feb  7 07:01:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
country_id: 2510769
description:
2025-02-07 07:01:22 dovecot_login authenticator failed for ([207.188.157.230]) [207.188.157.230]:2010: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Feb  7 07:00:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-07 07:00:29 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:39076: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
country_id: 690791
description:
2025-02-07 07:00:42 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:2055: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
country_id: 1880251
description:
2025-02-07 07:01:04 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:1151: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2025-02-07 07:00:59 dovecot_login authenticator failed for ([41.214.10.178]) [41.214.10.178]:49258: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
country_id: 1880251
description:
Feb  7 07:01:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
country_id: 2245662
description:
Feb  7 07:00:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
country_id: 1814991
description:
Feb  7 07:01:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.95.217
country_id: 6252001
description:
Feb  7 07:00:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.95.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  7 07:01:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
country_id: 2395170
description:
2025-02-07 07:01:23 dovecot_login authenticator failed for ([154.127.43.35]) [154.127.43.35]:37637: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
country_id: 1269750
description:
Feb  7 07:01:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  7 07:01:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-07 07:01:38 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:40860: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.68.71
country_id: 1835841
description:
2025-02-07 07:01:45 dovecot_login authenticator failed for ([220.85.68.71]) [220.85.68.71]:22361: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.34
country_id: 1562822
description:
Feb  7 07:02:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-02-07 07:02:18 dovecot_plain authenticator failed for (poloa) [65.20.250.63]:43674: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-07 07:01:29 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (gogal) [91.56.31.167]:61467: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.181
country_id: 6252001
description:
Feb  7 07:01:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
country_id: 1269750
description:
2025-02-07 07:01:36 dovecot_login authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:58907: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.63
country_id: 99237
description:
Feb  7 07:02:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  7 07:01:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.181
country_id: 6252001
description:
2025-02-07 07:01:32 dovecot_login authenticator failed for ([104.241.233.181]) [104.241.233.181]:43619: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.68.71
country_id: 1835841
description:
Feb  7 07:01:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.68.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
country_id: 6252001
description:
Feb  7 07:01:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
country_id: 1562822
description:
2025-02-07 07:02:20 dovecot_login authenticator failed for ([171.244.63.34]) [171.244.63.34]:38091: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
country_id: 6252001
description:
2025-02-07 07:01:52 dovecot_login authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:54520: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.134.209.86
country_id: 1814991
description:
Feb  7 07:02:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.134.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.40.61.246
country_id: 6252001
description:
[2025-02-07 07:02:21 +0100] info [cpaneld] 149.40.61.246 - abs18a00023y "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs18a00023y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-07 07:02:41 dovecot_login authenticator failed for ([210.113.122.243]) [210.113.122.243]:42064: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.226.207
country_id: 2661886
description:
Feb  7 07:02:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.183.247
country_id: 2510769
description:
Feb  7 07:02:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.183.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.183.247
country_id: 2510769
description:
2025-02-07 07:02:55 dovecot_plain authenticator failed for ([207.188.183.247]) [207.188.183.247]:43206: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 149.40.61.246
country_id: 6252001
description:
Feb  7 07:03:10 ait sshd[1643663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.40.61.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
country_id: 3017382
description:
2025-02-07 07:02:26 dovecot_login authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:36768: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
country_id: 1835841
description:
Feb  7 07:02:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.40.61.246
country_id: 6252001
description:
[2025-02-07 07:02:25 +0100] info [whostmgrd] 149.40.61.246 - abs18a00023y "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
country_id: 1814991
description:
Feb  7 07:02:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
country_id: 1814991
description:
2025-02-07 07:02:44 dovecot_plain authenticator failed for ([1.183.1.82]) [1.183.1.82]:43361: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
country_id: 3017382
description:
Feb  7 07:02:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
country_id: 1814991
description:
2025-02-07 07:02:24 dovecot_login authenticator failed for ([183.134.209.86]) [183.134.209.86]:58027: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.40.61.246
country_id: 6252001
description:
2025-02-07 07:02:47 dovecot_plain authenticator failed for ([100.80.254.91]) [149.40.61.246]:62686: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
country_id: 1643084
description:
Feb  7 07:03:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.226.207
country_id: 2661886
description:
2025-02-07 07:02:47 dovecot_plain authenticator failed for c188-150-226-207.bredband.tele2.se (oectic) [188.150.226.207]:41642: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
country_id: 3175395
description:
2025-02-07 07:04:20 dovecot_login authenticator failed for ([2.192.20.166]) [2.192.20.166]:45606: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
country_id: 1819730
description:
Feb  7 07:03:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
country_id: 1819730
description:
2025-02-07 07:03:36 dovecot_login authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:55767: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
country_id: 1835841
description:
Feb  7 07:03:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
country_id: 1835841
description:
2025-02-07 07:03:50 dovecot_login authenticator failed for ([123.212.20.131]) [123.212.20.131]:60390: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 07:04:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 07:04:06 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:55601: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
country_id: 2017370
description:
2025-02-07 07:04:11 dovecot_login authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:49508: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
country_id: 1643084
description:
2025-02-07 07:03:23 dovecot_login authenticator failed for (43-252-8-34.quantum.net.id) [43.252.8.34]:60006: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
country_id: 2017370
description:
Feb  7 07:04:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
country_id: 3175395
description:
Feb  7 07:04:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.13.237.163
country_id: 1835841
description:
2025-02-07 07:05:16 dovecot_login authenticator failed for ([59.13.237.163]) [59.13.237.163]:51838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 07:05:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-07 07:04:31 dovecot_login authenticator failed for ([103.62.233.146]) [103.62.233.146]:43308: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.8.245
country_id: 6252001
description:
Feb  7 07:04:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.8.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.8.245
country_id: 6252001
description:
2025-02-07 07:04:47 dovecot_plain authenticator failed for ([65.76.8.245]) [65.76.8.245]:43706: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.162
country_id: 1149361
description:
Feb  7 07:05:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.4.150.142
country_id: 1814991
description:
Feb  7 07:05:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.4.150.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
country_id: 1168579
description:
Feb  7 07:04:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  7 07:04:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  7 07:05:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.4.150.142
country_id: 1814991
description:
2025-02-07 07:05:08 dovecot_login authenticator failed for ([112.4.150.142]) [112.4.150.142]:53234: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.13.237.163
country_id: 1835841
description:
Feb  7 07:05:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.13.237.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.223.177.215
country_id: 1814991
description:
2025-02-07 07:04:38 dovecot_plain authenticator failed for ([223.223.177.220]) [223.223.177.215]:42783: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
country_id: 1149361
description:
2025-02-07 07:05:02 dovecot_login authenticator failed for ([149.54.15.162]) [149.54.15.162]:58494: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-07 07:05:13 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:26744: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-07 07:04:31 dovecot_login authenticator failed for ([39.174.90.48]) [39.174.90.43]:37624: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.223.177.215
country_id: 1814991
description:
Feb  7 07:04:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.223.177.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
country_id: 1814991
description:
2025-02-07 07:05:25 dovecot_login authenticator failed for ([123.139.133.238]) [123.139.133.238]:55572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Feb  7 07:05:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
country_id: 1269750
description:
Feb  7 07:05:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
country_id: 1269750
description:
2025-02-07 07:06:01 dovecot_plain authenticator failed for ([182.70.120.127]) [182.70.120.127]:59846: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.102.141.123
country_id: 6252001
description:
Feb  7 07:06:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.102.141.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  7 07:05:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Feb  7 07:05:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
country_id: 1814991
description:
2025-02-07 07:05:47 dovecot_login authenticator failed for ([123.182.89.19]) [123.182.89.19]:57969: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 07:05:53 dovecot_login authenticator failed for ([27.223.100.91]) [27.223.100.90]:34322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.231.17.194
country_id: 3865483
description:
Feb  7 07:05:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.231.17.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.46.148.53
country_id: 1605651
description:
Feb  7 07:05:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.46.148.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.17.194
country_id: 3865483
description:
2025-02-07 07:05:58 dovecot_login authenticator failed for ([152.231.17.200]) [152.231.17.194]:44409: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-02-07 07:05:34 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:47040: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-02-07 07:05:44 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:53064: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
country_id: 1814991
description:
Feb  7 07:05:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2025-02-07 07:05:59 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:51013: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
country_id: 2017370
description:
Feb  7 07:06:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
country_id: 2017370
description:
2025-02-07 07:06:09 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:52612: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
country_id: 1814991
description:
Feb  7 07:05:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-07 07:05:42 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:33942: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 07:05:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.102.141.123
country_id: 6252001
description:
2025-02-07 07:06:06 dovecot_login authenticator failed for ([75.102.141.123]) [75.102.141.123]:43062: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
country_id: 1835841
description:
2025-02-07 07:07:18 dovecot_login authenticator failed for ([58.230.236.82]) [58.230.236.82]:51814: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
country_id: 1835841
description:
Feb  7 07:06:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
country_id: 1835841
description:
2025-02-07 07:06:48 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:37184: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-07.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  7 07:07:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-07 07:07:15 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:39343: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
country_id: 1835841
description:
Feb  7 07:07:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-02-07 07:07:29 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:36849: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
country_id: 338010
description:
Feb  7 07:07:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
country_id: 338010
description:
2025-02-07 07:07:38 dovecot_login authenticator failed for ([197.156.115.37]) [197.156.115.37]:50236: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
country_id: 49518
description:
Feb  7 07:07:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-02-07 07:07:44 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:41854: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.249.147.129
country_id: 6252001
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-08.173.249.147.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
country_id: 1814991
description:
Feb  7 07:07:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.141.152
country_id: 2017370
description:
2025-02-07 07:08:44 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:51256: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.70
country_id: 1835841
description:
Feb  7 07:08:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
country_id: 2017370
description:
Feb  7 07:08:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
country_id: 1835841
description:
Feb  7 07:08:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-02-07 07:09:03 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:39458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2025-02-07 07:08:50 dovecot_plain authenticator failed for ([36.154.20.34]) [153.37.177.219]:51498: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
country_id: 1814991
description:
Feb  7 07:08:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.141.152
country_id: 2017370
description:
Feb  7 07:08:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.141.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-07 07:09:01 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:40326: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  7 07:09:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.70
country_id: 1835841
description:
2025-02-07 07:08:50 dovecot_login authenticator failed for ([106.246.89.70]) [106.246.89.70]:39650: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-02-07 07:08:57 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:55765: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
country_id: 1814991
description:
Feb  7 07:08:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 07:08:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
country_id: 1814991
description:
Feb  7 07:09:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
country_id: 1814991
description:
2025-02-07 07:08:59 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:41638: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
country_id: 6252001
description:
Feb  7 07:09:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-02-07 07:09:04 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:53198: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.230.21.158
country_id: 1880251
domain: titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-08.52.230.21.158||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
country_id: 1814991
description:
Feb  7 07:09:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
country_id: 1814991
description:
2025-02-07 07:09:14 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:51744: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
country_id: 1814991
description:
2025-02-07 07:09:18 dovecot_plain authenticator failed for ([222.132.167.110]) [222.132.167.110]:40762: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
country_id: 2017370
description:
2025-02-07 07:08:52 dovecot_login authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:52856: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Feb  7 07:08:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.234.61.113
country_id: 1522867
description:
[2025-02-07 07:10:06 +0100] info [webmaild] 185.234.61.113 - info@aitopen.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Feb  7 07:09:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2025-02-07 07:09:23 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:45340: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
country_id: 1814991
description:
2025-02-07 07:09:44 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:53380: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-02-07 07:09:47 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:50814: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
country_id: 2017370
description:
Feb  7 07:09:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.85.194
country_id: 1814991
description:
2025-02-07 07:09:49 dovecot_plain authenticator failed for ([183.233.85.194]) [183.233.85.194]:54656: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
country_id: 6252001
description:
2025-02-07 07:09:57 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:59433: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.43
country_id: 1668284
description:
2025-02-07 07:10:02 dovecot_login authenticator failed for 110-25-107-43.adsl.fetnet.net [110.25.107.43]:51961: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2025-02-07 07:09:30 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:47000: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-02-07 07:09:39 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:58531: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
country_id: 1814991
description:
Feb  7 07:09:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.62.117.48
country_id: 1814991
description:
2025-02-07 07:09:45 dovecot_login authenticator failed for ([117.62.117.48]) [117.62.117.48]:56077: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.85.194
country_id: 1814991
description:
Feb  7 07:09:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.85.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
country_id: 1835841
description:
2025-02-07 07:10:10 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:35422: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
country_id: 2635167
description:
Feb  7 07:09:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
country_id: 2635167
description:
2025-02-07 07:09:34 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:29603: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
country_id: 6252001
description:
Feb  7 07:09:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
country_id: 1835841
description:
Feb  7 07:10:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.57.125
country_id: 1668284
description:
Feb  7 07:09:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.57.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Feb  7 07:09:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
country_id: 1269750
description:
Feb  7 07:09:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
country_id: 2017370
description:
2025-02-07 07:09:53 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:59038: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.107.43
country_id: 1668284
description:
Feb  7 07:10:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.107.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
country_id: 1814991
description:
Feb  7 07:10:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2025-02-07 07:11:06 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:39702: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
country_id: 1668284
description:
Feb  7 07:11:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-07 07:11:20 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:49340: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
country_id: 3017382
description:
Feb  7 07:10:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
country_id: 3017382
description:
2025-02-07 07:10:37 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:57098: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
country_id: 1814991
description:
Feb  7 07:10:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
country_id: 1814991
description:
2025-02-07 07:10:51 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:39626: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
country_id: 1835841
description:
Feb  7 07:11:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
country_id: 1814991
description:
Feb  7 07:11:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
country_id: 1835841
description:
2025-02-07 07:11:05 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:43809: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 07:11:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.251
country_id: 1668284
description:
2025-02-07 07:11:20 dovecot_plain authenticator failed for 111-70-23-251.emome-ip.hinet.net [111.70.23.251]:57044: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
country_id: 1814991
description:
2025-02-07 07:10:47 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:35177: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
country_id: 1835841
description:
Feb  7 07:11:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.251
country_id: 1668284
description:
Feb  7 07:11:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-02-07 07:11:43 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:60607: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.134.146
country_id: 1814991
description:
Feb  7 07:12:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.134.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.193.131
country_id: 298795
description:
Feb  7 07:11:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.193.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 07:11:30 ait sshd[1646438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.193.131
country_id: 298795
description:
2025-02-07 07:11:32 dovecot_login authenticator failed for ([5.26.193.131]) [5.26.193.131]:52068: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
country_id: 2017370
description:
2025-02-07 07:12:01 dovecot_plain authenticator failed for ([83.237.42.54]) [83.237.42.54]:55772: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-07 07:12:05 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:37392: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
country_id: 2017370
description:
Feb  7 07:11:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  7 07:12:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
country_id: 1814991
description:
2025-02-07 07:12:06 dovecot_plain authenticator failed for ([36.154.134.146]) [36.154.134.146]:44701: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 07:11:30 ait sshd[1646438]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.73.230
country_id: 3469034
description:
[2025-02-07 07:11:35 +0100] info [webmaild] 179.0.73.230 - info@university-publishing.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
country_id: 2017370
description:
2025-02-07 07:12:13 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:58490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
country_id: 2077456
description:
Feb  7 07:11:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
country_id: 1269750
description:
Feb  7 07:11:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-02-07 07:11:32 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:56118: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
country_id: 2658434
description:
Feb  7 07:11:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
country_id: 1835841
description:
Feb  7 07:11:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
country_id: 2017370
description:
Feb  7 07:12:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2025-02-07 07:11:22 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:49078: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
country_id: 2077456
description:
2025-02-07 07:11:36 dovecot_plain authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:54637: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
country_id: 1835841
description:
2025-02-07 07:11:45 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:36684: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Feb  7 07:11:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-02-07 07:11:52 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:38962: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.56.252.11
country_id: 2963597
description:
2025-02-07 07:12:57 dovecot_login authenticator failed for (ADMIN) [193.56.252.11]:43664: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
country_id: 1835841
description:
Feb  7 07:13:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
country_id: 1835841
description:
2025-02-07 07:13:12 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:51278: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.56.252.11
country_id: 2963597
description:
Feb  7 07:12:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.56.252.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.226
country_id: 1819730
description:
Feb  7 07:13:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  7 07:14:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
country_id: 1668284
description:
Feb  7 07:14:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
country_id: 1819730
description:
Feb  7 07:13:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-07 07:13:27 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:60659: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
country_id: 290557
description:
Feb  7 07:13:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-02-07 07:13:41 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:46555: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.194.58
country_id: 1814991
description:
Feb  7 07:13:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.194.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.226
country_id: 1819730
description:
2025-02-07 07:13:53 dovecot_plain authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:63310: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.211.194.58
country_id: 1814991
description:
2025-02-07 07:13:55 dovecot_login authenticator failed for ([60.211.194.58]) [60.211.194.58]:38126: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-07 07:14:05 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:38713: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2025-02-07 07:14:13 dovecot_plain authenticator failed for ([101.13.4.119]) [101.13.4.119]:44278: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  7 07:14:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
country_id: 1605651
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:07-14.202.29.30.124


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 07:15:18 ait sshd[1647701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 07:15:18 ait sshd[1647701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-07 07:14:26 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:59622: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.182.230.76
country_id: 3865483
description:
Feb  7 07:15:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.182.230.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.182.230.76
country_id: 3865483
description:
2025-02-07 07:15:15 dovecot_plain authenticator failed for (76.230.182.190.unassigned.ridsa.com.ar) [190.182.230.76]:35843: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
country_id: 1835841
description:
2025-02-07 07:15:53 dovecot_login authenticator failed for ([211.186.220.42]) [211.186.220.42]:34995: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
country_id: 3175395
description:
Feb  7 07:16:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
country_id: 3175395
description:
2025-02-07 07:16:07 dovecot_login authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:51544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.95.97.158
country_id: 1814991
description:
Feb  7 07:15:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.95.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.95.97.158
country_id: 1814991
description:
2025-02-07 07:15:28 dovecot_plain authenticator failed for ([180.166.163.26]) [101.95.97.158]:52764: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
country_id: 1835841
description:
Feb  7 07:15:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.126.75.206
country_id: 6252001
description:
Feb  7 07:17:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.126.75.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
country_id: 2750405
description:
Feb  7 07:17:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.49.178
country_id: 1880251
description:
47.128.49.178 - - [07/Feb/2025:07:16:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7596318 HTTP/2.0" 302 0 admission.ait-edu.us "https://admission.ait-edu.us/litora-torqent-per-conubia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.49.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.67.14
country_id: 6252001
description:
Feb  7 07:16:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.67.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
country_id: 1819730
description:
Feb  7 07:16:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
country_id: 1814991
description:
Feb  7 07:17:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
country_id: 1814991
description:
2025-02-07 07:17:17 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:59644: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
country_id: 1819730
description:
2025-02-07 07:16:55 dovecot_login authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:33581: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.126.75.206
country_id: 6252001
description:
2025-02-07 07:17:12 dovecot_login authenticator failed for chil-pppoe-74-126-75-206.dsl.bright.net [74.126.75.206]:58519: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.67.14
country_id: 6252001
description:
2025-02-07 07:16:39 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:58845: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-02-07 07:17:22 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:34790: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 07:17:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 07:17:58 dovecot_plain authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:35322: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-07 07:18:21 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:38564: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
country_id: 3469034
description:
Feb  7 07:17:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-07 07:17:40 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:57890: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.59.247.91
country_id: 1522867
description:
[2025-02-07 07:18:09 +0100] info [webmaild] 95.59.247.91 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  7 07:18:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.158.175
country_id: 294640
description:
Feb  7 07:18:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.158.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.158.175
country_id: 294640
description:
2025-02-07 07:18:51 dovecot_plain authenticator failed for ([195.133.158.175]) [195.133.158.175]:39071: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.205
country_id: 1668284
description:
Feb  7 07:19:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.205
country_id: 1668284
description:
2025-02-07 07:19:02 dovecot_plain authenticator failed for 111-70-25-205.emome-ip.hinet.net [111.70.25.205]:55212: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
country_id: 2077456
description:
Feb  7 07:19:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
country_id: 2077456
description:
2025-02-07 07:19:12 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:45972: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
country_id: 690791
description:
Feb  7 07:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.85
country_id: 1819730
description:
Feb  7 07:20:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
country_id: 1814991
description:
2025-02-07 07:20:21 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:59969: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
country_id: 3017382
description:
Feb  7 07:20:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
country_id: 6252001
description:
Feb  7 07:20:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
country_id: 298795
description:
Feb  7 07:20:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
country_id: 2017370
description:
Feb  7 07:20:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
country_id: 6252001
description:
2025-02-07 07:20:17 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:22675: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.149.173.90
country_id: 1814991
description:
Feb  7 07:20:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.149.173.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
country_id: 1814991
description:
Feb  7 07:20:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 07:19:55 ait sshd[1649049]: Invalid user universitypublishing from 211.108.234.111 port 34764


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 07:19:55 ait sshd[1649049]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 07:19:55 ait sshd[1649049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  7 07:20:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
country_id: 1861060
description:
Feb  7 07:20:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.85
country_id: 1819730
description:
2025-02-07 07:20:22 dovecot_plain authenticator failed for (m121-202-152-85.smartone.com) [121.202.152.85]:12773: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 07:20:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-02-07 07:20:16 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:42604: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
country_id: 294640
description:
Feb  7 07:20:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
country_id: 298795
description:
2025-02-07 07:20:18 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:40658: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
country_id: 3469034
description:
Feb  7 07:20:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
country_id: 1814991
description:
Feb  7 07:19:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
country_id: 1562822
description:
Feb  7 07:19:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-07 07:19:58 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:49201: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.149.173.90
country_id: 1814991
description:
2025-02-07 07:20:21 dovecot_plain authenticator failed for ([117.149.173.90]) [117.149.173.90]:58872: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-07 07:20:22 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:55058: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-02-07 07:20:22 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:37751: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
country_id: 3895114
description:
Feb  7 07:20:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Feb  7 07:20:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
country_id: 1880251
description:
Feb  7 07:20:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
country_id: 294640
description:
2025-02-07 07:20:18 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:41366: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
country_id: 690791
description:
2025-02-07 07:19:27 dovecot_plain authenticator failed for (therchect) [109.108.95.66]:44175: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
country_id: 1814991
description:
2025-02-07 07:19:33 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:38930: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 07:20:02 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:57238: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
country_id: 2017370
description:
2025-02-07 07:20:08 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:58938: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
country_id: 3017382
description:
2025-02-07 07:20:15 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:58490: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
country_id: 1880251
description:
2025-02-07 07:20:18 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2597: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  7 07:20:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.116.134
country_id: 1814991
description:
Feb  7 07:20:28 ait sshd[1649547]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.116.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
country_id: 1814991
description:
Feb  7 07:20:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
country_id: 1814991
description:
2025-02-07 07:20:38 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:30196: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 07:21:18 ait sshd[1649948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.238
country_id: 1814991
description:
Feb  7 07:21:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
country_id: 1819730
description:
2025-02-07 07:20:27 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:57251: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
country_id: 1819730
description:
Feb  7 07:20:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-02-07 07:20:36 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:58746: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 07:20:43 dovecot_plain authenticator failed for (nsg-static-172.125.76.182-airtel.com) [182.76.87.90]:60434: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
country_id: 2077456
description:
Feb  7 07:20:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.142.210.138
country_id: 1814991
description:
2025-02-07 07:20:37 dovecot_plain authenticator failed for ([61.142.210.138]) [61.142.210.138]:64919: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
country_id: 2017370
description:
Feb  7 07:20:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
country_id: 3469034
description:
2025-02-07 07:21:16 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:60346: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-07 07:20:50 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:47613: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
country_id: 2077456
description:
2025-02-07 07:20:53 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:36043: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-02-07 07:20:24 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:47363: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
country_id: 2017370
description:
Feb  7 07:20:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-07 07:20:35 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:44798: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.151
country_id: 1814991
description:
Feb  7 07:20:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.151
country_id: 1814991
description:
2025-02-07 07:21:00 dovecot_plain authenticator failed for ([60.223.239.151]) [60.223.239.151]:33490: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-07 07:20:26 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:12560: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
country_id: 1835841
description:
Feb  7 07:20:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.102.141.123
country_id: 6252001
description:
2025-02-07 07:20:35 dovecot_plain authenticator failed for ([75.102.141.123]) [75.102.141.123]:38843: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 07:20:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
country_id: 1814991
description:
Feb  7 07:20:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-02-07 07:20:37 dovecot_plain authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:60463: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.69.23.79
country_id: 6251999
domain: naric.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/cache.php||SC:/home/titlemas/public_html/naric.us/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
country_id: 1819730
description:
Feb  7 07:20:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.116.134
country_id: 1814991
description:
Feb  7 07:20:28 ait sshd[1649547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.116.134  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
country_id: 2017370
description:
2025-02-07 07:20:28 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:39738: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.238
country_id: 1814991
description:
2025-02-07 07:21:13 dovecot_plain authenticator failed for ([221.195.208.238]) [221.195.208.238]:63500: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 07:21:18 ait sshd[1649948]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
country_id: 3895114
description:
2025-02-07 07:20:24 dovecot_plain authenticator failed for ([45.165.170.41]) [45.165.170.41]:52910: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  7 07:20:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2025-02-07 07:20:41 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:33330: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
country_id: 3469034
description:
Feb  7 07:21:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.41.77.185
country_id: 3469034
description:
[2025-02-07 07:21:14 +0100] info [webmaild] 177.41.77.185 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.102.141.123
country_id: 6252001
description:
Feb  7 07:20:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.102.141.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
country_id: 1814991
description:
2025-02-07 07:20:38 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:49953: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.117.226
country_id: 1562822
description:
2025-02-07 07:20:38 dovecot_plain authenticator failed for ([103.95.156.1]) [42.1.117.226]:55292: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
country_id: 1814991
description:
Feb  7 07:20:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.142.210.138
country_id: 1814991
description:
Feb  7 07:20:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.142.210.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.1.117.226
country_id: 1562822
description:
Feb  7 07:20:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.1.117.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: naric.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-20.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Feb  7 07:20:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
country_id: 1814991
description:
2025-02-07 07:21:01 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:45463: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-22.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.3
country_id: 1821275
description:
2025-02-07 07:21:37 dovecot_login authenticator failed for (ADMIN) [84.252.92.3]:47278: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.158.175
country_id: 294640
description:
Feb  7 07:21:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.158.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.158.175
country_id: 294640
description:
2025-02-07 07:21:54 dovecot_login authenticator failed for ([195.133.158.175]) [195.133.158.175]:46885: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
country_id: 3469034
description:
Feb  7 07:22:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-07 07:22:04 dovecot_login authenticator failed for ([189.39.187.16]) [189.39.187.16]:58158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
country_id: 6252001
description:
2025-02-07 07:23:18 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:35431: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
country_id: 3469034
description:
2025-02-07 07:23:18 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:45061: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
country_id: 1819730
description:
Feb  7 07:23:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
country_id: 1814991
description:
Feb  7 07:23:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
country_id: 3469034
description:
Feb  7 07:23:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-07 07:23:16 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:32279: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
country_id: 6252001
description:
Feb  7 07:23:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
country_id: 1814991
description:
2025-02-07 07:23:17 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:52888: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-02-07 07:23:25 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg (95-87-248-223.net1.bg) [95.87.248.223]:45750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  7 07:23:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
country_id: 1819730
description:
2025-02-07 07:23:30 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:38624: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-07 07:23:32 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:41265: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  7 07:23:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.254.233
country_id: 1835841
description:
2025-02-07 07:24:05 dovecot_login authenticator failed for ([175.207.254.233]) [175.207.254.233]:38685: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
country_id: 1835841
description:
Feb  7 07:23:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
country_id: 1814991
description:
Feb  7 07:23:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.254.233
country_id: 1835841
description:
Feb  7 07:24:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.254.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
country_id: 294640
description:
Feb  7 07:24:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
country_id: 1835841
description:
2025-02-07 07:23:32 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:54923: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-07 07:23:41 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:60135: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  7 07:23:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-07 07:23:45 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:47431: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
country_id: 1814991
description:
2025-02-07 07:23:51 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:41714: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
country_id: 294640
description:
2025-02-07 07:24:14 dovecot_login authenticator failed for ([130.185.96.125]) [130.185.96.125]:44146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Feb  7 07:23:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
country_id: 1819730
description:
Feb  7 07:23:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.126.123.170
country_id: 2750405
description:
Feb  7 07:25:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.126.123.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.126.123.170
country_id: 2750405
description:
2025-02-07 07:25:11 dovecot_login authenticator failed for d57e7baa.static.ziggozakelijk.nl (y9UWPdt) [213.126.123.170]:4566: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.49.86.45
country_id: 3865483
description:
[2025-02-07 07:24:32 +0100] info [webmaild] 190.49.86.45 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
country_id: 1835841
description:
2025-02-07 07:25:45 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:54238: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
country_id: 2661886
description:
Feb  7 07:26:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.191.170.208
country_id: 6252001
description:
2025-02-07 07:26:16 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:36730: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Feb  7 07:25:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-02-07 07:25:31 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:55009: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
country_id: 1835841
description:
Feb  7 07:25:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.191.170.208
country_id: 6252001
description:
Feb  7 07:26:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.191.170.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-02-07 07:26:16 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (vergallium) [81.225.30.107]:40096: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
country_id: 1814991
description:
Feb  7 07:26:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
country_id: 1814991
description:
2025-02-07 07:26:27 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:14944: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
country_id: 1814991
description:
Feb  7 07:27:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
country_id: 2750405
description:
Feb  7 07:27:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-02-07 07:27:10 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:45914: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
country_id: 1814991
description:
Feb  7 07:27:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-02-07 07:27:02 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:48417: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
country_id: 1814991
description:
2025-02-07 07:27:20 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:48010: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  7 07:28:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.31.76
country_id: 290557
description:
2025-02-07 07:27:35 dovecot_login authenticator failed for (ek6HWuPqNJ) [94.207.31.76]:55379: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.175.120.25
country_id: 2782113
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:07-28.83.175.120.25


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
country_id: 1835841
description:
Feb  7 07:28:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-02-07 07:28:12 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:33134: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-02-07 07:28:21 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:38146: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.213.84
country_id: 1835841
description:
Feb  7 07:27:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.213.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.213.84
country_id: 1835841
description:
2025-02-07 07:27:37 dovecot_plain authenticator failed for ([125.143.213.84]) [125.143.213.84]:52901: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
country_id: 1269750
description:
Feb  7 07:28:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-07 07:28:20 dovecot_login authenticator failed for ([111.48.214.96]) [111.48.214.96]:28384: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
country_id: 1819730
description:
Feb  7 07:28:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.238.85
country_id: 1269750
description:
2025-02-07 07:28:57 dovecot_plain authenticator failed for (abts-west-static-85.238.201.106.airtelbroadband.in) [106.201.238.85]:49243: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
country_id: 1819730
description:
2025-02-07 07:28:24 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:34742: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-07 07:28:37 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:55187: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
country_id: 6252001
description:
2025-02-07 07:28:40 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:49446: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
country_id: 1814991
description:
Feb  7 07:28:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
country_id: 3469034
description:
Feb  7 07:29:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.211.125
country_id: 1814991
description:
Feb  7 07:28:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.211.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.37.17
country_id: 1880251
description:
2025-02-07 07:29:05 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:37546: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.201.238.85
country_id: 1269750
description:
Feb  7 07:28:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.201.238.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.37.17
country_id: 1880251
description:
Feb  7 07:29:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.37.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.211.125
country_id: 1814991
description:
2025-02-07 07:28:30 dovecot_login authenticator failed for ([113.64.211.125]) [113.64.211.125]:40281: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: iric.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-28.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
country_id: 1814991
description:
2025-02-07 07:28:45 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:21011: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
country_id: 3469034
description:
2025-02-07 07:29:02 dovecot_plain authenticator failed for ([179.124.54.6]) [179.124.54.6]:39149: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Feb  7 07:29:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-02-07 07:29:19 dovecot_plain authenticator failed for (spileous) [102.53.15.18]:34462: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
country_id: 2921044
description:
Feb  7 07:28:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
country_id: 6252001
description:
Feb  7 07:28:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.118.70
country_id: 1880251
description:
47.128.118.70 - - [07/Feb/2025:07:28:37 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 www.ait-edu.us "https://www.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16994200" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.70


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 64.227.171.131
country_id: 1269750
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-29.64.227.171.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
country_id: 732800
description:
Feb  7 07:29:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
country_id: 732800
description:
2025-02-07 07:29:53 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:44740: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
country_id: 6252001
description:
Feb  7 07:30:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-02-07 07:30:02 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:52592: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
country_id: 2017370
description:
2025-02-07 07:30:29 dovecot_plain authenticator failed for (miacer) [81.211.77.58]:12209: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
country_id: 1814991
description:
Feb  7 07:31:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
country_id: 1814991
description:
2025-02-07 07:31:07 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:36671: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.148.130.25
country_id: 1062947
description:
2025-02-07 07:31:19 dovecot_login authenticator failed for ([197.148.130.25]) [197.148.130.25]:46859: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
country_id: 2017370
description:
Feb  7 07:30:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
country_id: 1814991
description:
Feb  7 07:30:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
country_id: 1814991
description:
2025-02-07 07:30:56 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:33818: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
country_id: 3469034
description:
Feb  7 07:31:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.138.18
country_id: 3469034
description:
2025-02-07 07:31:09 dovecot_login authenticator failed for ([189.44.138.18]) [189.44.138.18]:48748: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.148.130.25
country_id: 1062947
description:
Feb  7 07:31:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.148.130.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-07 07:31:44 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:58356: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-07 07:31:49 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:42200: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.207.72
country_id: 1814991
description:
Feb  7 07:31:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.207.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-07 07:32:00 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:51570: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.15.177.173
country_id: 1814991
description:
Feb  7 07:32:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.15.177.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.15.177.173
country_id: 1814991
description:
2025-02-07 07:32:05 dovecot_plain authenticator failed for ([121.15.177.173]) [121.15.177.173]:55766: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
country_id: 1814991
description:
Feb  7 07:32:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.242.204.22
country_id: 1814991
description:
2025-02-07 07:31:36 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:5266: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  7 07:31:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  7 07:31:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.242.204.22
country_id: 1814991
description:
Feb  7 07:31:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.242.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.246.89.195
country_id: 1814991
description:
2025-02-07 07:31:49 dovecot_plain authenticator failed for ([183.246.89.195]) [183.246.89.195]:43658: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.246.89.195
country_id: 1814991
description:
Feb  7 07:31:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.246.89.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
country_id: 1861060
description:
Feb  7 07:32:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.207.72
country_id: 1814991
description:
2025-02-07 07:31:26 dovecot_plain authenticator failed for ([120.236.207.72]) [120.236.207.72]:58572: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
country_id: 1835841
description:
Feb  7 07:31:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.192.226.83
country_id: 2017370
description:
Feb  7 07:32:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.192.226.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.226.83
country_id: 2017370
description:
2025-02-07 07:32:50 dovecot_plain authenticator failed for ([62.192.226.83]) [62.192.226.83]:41894: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
country_id: 2017370
description:
2025-02-07 07:32:39 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:59134: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  7 07:32:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
country_id: 1814991
description:
Feb  7 07:32:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.236.183
country_id: 1814991
description:
2025-02-07 07:33:00 dovecot_plain authenticator failed for ([27.45.236.183]) [27.45.236.183]:42028: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  7 07:33:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
country_id: 3932488
description:
Feb  7 07:33:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
country_id: 1835841
description:
Feb  7 07:33:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
country_id: 1835841
description:
2025-02-07 07:33:20 dovecot_plain authenticator failed for ([220.77.182.169]) [220.77.182.169]:32866: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
country_id: 1562822
description:
2025-02-07 07:32:33 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:50452: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
country_id: 2017370
description:
Feb  7 07:32:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
country_id: 6252001
description:
2025-02-07 07:33:00 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:56488: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.245.186
country_id: 3469034
description:
Feb  7 07:32:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.245.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
country_id: 1814991
description:
Feb  7 07:33:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
country_id: 3469034
description:
2025-02-07 07:32:36 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:36423: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
country_id: 1814991
description:
Feb  7 07:32:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.17.125.28
country_id: 1814991
description:
2025-02-07 07:32:59 dovecot_plain authenticator failed for ([120.55.170.138]) [183.17.125.28]:7595: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.249.163.4
country_id: 6251999
description:
2025-02-07 07:32:45 dovecot_plain authenticator failed for ([162.249.163.4]) [162.249.163.4]:53457: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
country_id: 1814991
description:
2025-02-07 07:32:47 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:42094: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-07 07:32:53 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:49514: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-02-07 07:33:01 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:50140: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-07 07:33:09 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:58760: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.220
country_id: 99237
description:
2025-02-07 07:32:32 dovecot_plain authenticator failed for (cology) [65.20.253.220]:57776: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.60.24
country_id: 2017370
description:
Feb  7 07:32:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.60.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Feb  7 07:32:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.227
country_id: 3469034
description:
Feb  7 07:33:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-02-07 07:33:13 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:40648: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
country_id: 3469034
description:
2025-02-07 07:32:50 dovecot_plain authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:47691: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
country_id: 3469034
description:
Feb  7 07:32:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  7 07:32:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
country_id: 597427
description:
2025-02-07 07:32:40 dovecot_plain authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:50276: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
country_id: 1814991
description:
2025-02-07 07:33:09 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:46278: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-02-07 07:32:42 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:54052: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  7 07:32:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.236.183
country_id: 1814991
description:
Feb  7 07:32:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.236.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
country_id: 3469034
description:
Feb  7 07:32:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.102.90
country_id: 1814991
description:
Feb  7 07:32:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.102.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-02-07 07:32:39 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:38102: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
country_id: 1814991
description:
2025-02-07 07:32:44 dovecot_plain authenticator failed for ([39.88.252.16]) [39.88.252.16]:50414: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-02-07 07:32:44 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:60749: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.17.125.28
country_id: 1814991
description:
Feb  7 07:32:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.17.125.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
country_id: 1861060
description:
2025-02-07 07:32:22 dovecot_plain authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.229]:41611: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.249.163.4
country_id: 6251999
description:
Feb  7 07:32:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.249.163.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 07:32:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.227
country_id: 3469034
description:
2025-02-07 07:33:12 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.157.227]:55042: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2025-02-07 07:32:22 dovecot_plain authenticator failed for ([222.186.68.153]) [222.186.68.153]:60265: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 07:32:46 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-196.tpgi.com.au) [110.175.220.250]:36931: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
country_id: 1814991
description:
2025-02-07 07:32:56 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:42715: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
country_id: 3658394
description:
Feb  7 07:32:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
country_id: 6252001
description:
Feb  7 07:32:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-07 07:32:42 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:43875: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  7 07:32:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
country_id: 3469034
description:
Feb  7 07:32:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  7 07:32:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
country_id: 1814991
description:
2025-02-07 07:32:58 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:52091: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-07 07:32:58 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:35972: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-07 07:32:48 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:49676: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  7 07:32:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.220
country_id: 99237
description:
Feb  7 07:32:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
country_id: 1819730
description:
Feb  7 07:32:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-07 07:32:42 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:36490: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-07 07:32:56 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:52133: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.245.186
country_id: 3469034
description:
2025-02-07 07:32:58 dovecot_plain authenticator failed for 131.0.245.186.core3.com.br [131.0.245.186]:41134: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.206.91.51
country_id: 597427
description:
Feb  7 07:32:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.206.91.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
country_id: 2017370
description:
2025-02-07 07:32:41 dovecot_plain authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:58792: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
country_id: 1814991
description:
Feb  7 07:32:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-02-07 07:33:11 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:47078: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
country_id: 458258
description:
Feb  7 07:33:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
country_id: 1562822
description:
Feb  7 07:32:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
country_id: 6252001
description:
Feb  7 07:32:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
country_id: 2440476
description:
Feb  7 07:32:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
country_id: 3658394
description:
2025-02-07 07:32:52 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:47608: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-07 07:32:53 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:58096: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
country_id: 1835841
description:
Feb  7 07:33:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-02-07 07:33:27 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:41732: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.100.145
country_id: 1668284
description:
Feb  7 07:35:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.100.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-02-07 07:35:38 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:57132: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
country_id: 1562822
description:
Feb  7 07:35:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.90.89.66
country_id: 3686110
description:
Feb  7 07:36:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.90.89.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-02-07 07:35:52 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:39686: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
country_id: 1814991
description:
Feb  7 07:35:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
country_id: 1819730
description:
2025-02-07 07:35:42 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:19440: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
country_id: 1643084
description:
Feb  7 07:35:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.100.145
country_id: 1668284
description:
2025-02-07 07:35:39 dovecot_plain authenticator failed for 110-25-100-145.adsl.fetnet.net [110.25.100.145]:39277: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.4
country_id: 294640
description:
2025-02-07 07:35:40 dovecot_plain authenticator failed for ([2.55.85.4]) [2.55.85.4]:35558: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
country_id: 1814991
description:
Feb  7 07:35:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.148.41
country_id: 1819730
description:
2025-02-07 07:35:53 dovecot_plain authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:59275: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  7 07:35:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
country_id: 1814991
description:
2025-02-07 07:35:58 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:57838: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  7 07:35:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.141.73
country_id: 1814991
description:
2025-02-07 07:35:41 dovecot_plain authenticator failed for ([120.194.141.73]) [120.194.141.73]:37667: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Feb  7 07:35:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-07 07:35:57 dovecot_login authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:58252: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.141.73
country_id: 1814991
description:
Feb  7 07:35:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.141.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
country_id: 1819730
description:
Feb  7 07:35:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-07 07:35:34 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:35748: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.153.49
country_id: 1814991
description:
Feb  7 07:35:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.153.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
country_id: 3686110
description:
2025-02-07 07:36:09 dovecot_plain authenticator failed for ([66.90.89.66]) [66.90.89.66]:35984: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
country_id: 1522867
description:
Feb  7 07:35:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.30.217.31
country_id: 2017370
description:
2025-02-07 07:35:30 dovecot_login authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:56002: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
country_id: 1522867
description:
2025-02-07 07:35:43 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:37325: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.148.41
country_id: 1819730
description:
Feb  7 07:35:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.148.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
country_id: 1814991
description:
2025-02-07 07:35:57 dovecot_plain authenticator failed for ([221.2.153.49]) [221.2.153.49]:60412: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.30.217.31
country_id: 2017370
description:
Feb  7 07:35:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.30.217.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
country_id: 1814991
description:
2025-02-07 07:35:52 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:52738: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2025-02-07 07:35:54 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:43676: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.4
country_id: 294640
description:
Feb  7 07:35:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 07:37:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-37.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
country_id: 99237
description:
2025-02-07 07:37:36 dovecot_plain authenticator failed for (trous) [65.20.162.187]:49416: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
country_id: 1668284
description:
Feb  7 07:38:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-07 07:37:58 dovecot_plain authenticator failed for (chins) [77.51.214.170]:47256: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
country_id: 2017370
description:
Feb  7 07:38:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.187
country_id: 99237
description:
Feb  7 07:37:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  7 07:37:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
country_id: 1668284
description:
2025-02-07 07:38:12 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:60946: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
country_id: 2017370
description:
2025-02-07 07:38:22 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:43694: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.148.191
country_id: 2661886
description:
2025-02-07 07:39:18 dovecot_plain authenticator failed for c188-148-148-191.bredband.tele2.se (chatic) [188.148.148.191]:58221: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-07 07:40:24 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:50651: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
country_id: 2661886
description:
Feb  7 07:40:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
country_id: 1814991
description:
Feb  7 07:40:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.9.212.84
country_id: 3686110
description:
[2025-02-07 07:40:52 +0100] info [webmaild] 190.9.212.84 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
country_id: 2017370
description:
2025-02-07 07:40:53 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:54593: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
country_id: 1814991
description:
2025-02-07 07:40:55 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:51082: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
country_id: 2921044
description:
Feb  7 07:40:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
country_id: 2661886
description:
2025-02-07 07:40:37 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:46474: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
country_id: 2017370
description:
Feb  7 07:40:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
country_id: 2017370
description:
2025-02-07 07:40:42 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:52236: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.92.193
country_id: 2017370
description:
Feb  7 07:40:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.92.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.165.74.91
country_id: 3469034
description:
[2025-02-07 07:40:35 +0100] info [webmaild] 179.165.74.91 - info@aitsmartschool.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-02-07 07:41:30 dovecot_plain authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:35165: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
country_id: 6252001
description:
2025-02-07 07:41:48 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:58783: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 07:41:24 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:43808: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
country_id: 6252001
description:
Feb  7 07:41:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 69.160.112.30
country_id: 3489940
description:
[2025-02-07 07:41:32 +0100] info [webmaild] 69.160.112.30 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
country_id: 6252001
description:
Feb  7 07:41:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
country_id: 1814991
description:
Feb  7 07:42:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
country_id: 1814991
description:
Feb  7 07:42:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-07 07:42:27 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:39832: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
country_id: 1814991
description:
2025-02-07 07:42:41 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:44588: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
country_id: 2017370
description:
2025-02-07 07:43:41 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:59176: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.109.20.192
country_id: 1643084
description:
Feb  7 07:43:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.109.20.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
country_id: 1643084
description:
2025-02-07 07:43:55 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:59115: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.141.228.9
country_id: 2017370
description:
Feb  7 07:44:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.141.228.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  7 07:43:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-07 07:43:33 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (phants) [92.244.126.105]:38056: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
country_id: 2017370
description:
Feb  7 07:43:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.141.228.9
country_id: 2017370
description:
2025-02-07 07:44:15 dovecot_plain authenticator failed for ([95.141.228.9]) [95.141.228.9]:53630: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
country_id: 2921044
description:
Feb  7 07:45:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  7 07:45:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.247.227.109
country_id: 1814991
description:
2025-02-07 07:45:07 dovecot_plain authenticator failed for ([223.247.227.109]) [223.247.227.109]:44900: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
country_id: 3703430
description:
2025-02-07 07:45:07 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:59290: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-07 07:44:27 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:45735: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.247.227.109
country_id: 1814991
description:
Feb  7 07:45:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.247.227.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
country_id: 1668284
description:
Feb  7 07:45:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.216.33.31
country_id: 1269750
description:
Feb  7 07:45:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.216.33.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.241
country_id: 6252001
description:
2025-02-07 07:45:16 dovecot_plain authenticator failed for (mobile-166-195-196-241.mycingular.net) [166.195.196.241]:50835: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  7 07:45:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-07 07:45:18 dovecot_plain authenticator failed for ([58.216.101.162]) [58.216.101.162]:39665: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 07:45:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
country_id: 2017370
description:
Feb  7 07:45:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
country_id: 3469034
description:
Feb  7 07:45:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
country_id: 2510769
description:
Feb  7 07:44:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.7.111.87
country_id: 1814991
description:
2025-02-07 07:45:09 dovecot_plain authenticator failed for ([36.7.111.87]) [36.7.111.87]:55202: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
country_id: 2328926
description:
2025-02-07 07:45:19 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:51006: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
country_id: 3469034
description:
Feb  7 07:44:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
country_id: 3469034
description:
2025-02-07 07:44:44 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:60291: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.224.226
country_id: 1269750
description:
2025-02-07 07:44:47 dovecot_plain authenticator failed for (nsg-corporate-226.224.187.122.airtel.in) [122.187.224.226]:45216: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-02-07 07:45:06 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:58080: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-02-07 07:45:06 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:58548: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.14
country_id: 1814991
description:
2025-02-07 07:45:07 dovecot_plain authenticator failed for ([124.115.231.14]) [124.115.231.14]:34605: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.70.129.101
country_id: 6252001
description:
Feb  7 07:45:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.70.129.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.241
country_id: 6252001
description:
Feb  7 07:45:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
country_id: 1643084
description:
2025-02-07 07:45:15 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:54646: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
country_id: 2328926
description:
Feb  7 07:45:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.32.145
country_id: 1814991
description:
2025-02-07 07:45:19 dovecot_plain authenticator failed for ([117.158.40.228]) [39.164.32.145]:44383: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
country_id: 1814991
description:
2025-02-07 07:45:21 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:53936: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
country_id: 3469034
description:
Feb  7 07:45:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
country_id: 6252001
description:
2025-02-07 07:45:13 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:37350: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.172
country_id: 1814991
description:
2025-02-07 07:45:14 dovecot_plain authenticator failed for ([163.179.123.172]) [163.179.123.172]:58584: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.4.18
country_id: 1880251
description:
Feb  7 07:45:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.4.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
country_id: 2750405
description:
2025-02-07 07:45:21 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:36732: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  7 07:44:24 ait sshd[1658195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.173.2.140
country_id: 298795
description:
Feb  7 07:44:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.173.2.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.226
country_id: 1269750
description:
Feb  7 07:44:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-07 07:45:02 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:36681: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
country_id: 1814991
description:
Feb  7 07:45:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 07:45:21 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:48770: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  7 07:44:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
country_id: 1269750
description:
2025-02-07 07:45:06 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:34532: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
country_id: 1668284
description:
2025-02-07 07:45:10 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:34413: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-02-07 07:45:12 dovecot_plain authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:49746: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.123.172
country_id: 1814991
description:
Feb  7 07:45:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.123.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.32.145
country_id: 1814991
description:
Feb  7 07:45:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.32.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
country_id: 1819730
description:
Feb  7 07:44:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.173.2.140
country_id: 298795
description:
2025-02-07 07:44:33 dovecot_plain authenticator failed for ([95.173.2.140]) [95.173.2.140]:48875: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.174.142.78
country_id: 1814991
description:
Feb  7 07:45:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.174.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-07 07:45:05 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:47298: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Feb  7 07:45:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-02-07 07:45:16 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:40201: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
country_id: 2017370
description:
2025-02-07 07:45:21 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:47740: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-07 07:44:33 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:20690: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.238.102.131
country_id: 1861060
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-44.54.238.102.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2025-02-07 07:45:03 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:57824: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.14
country_id: 1814991
description:
Feb  7 07:45:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
country_id: 1814991
description:
2025-02-07 07:45:07 dovecot_plain authenticator failed for ([222.174.142.78]) [222.174.142.78]:9441: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
country_id: 6252001
description:
Feb  7 07:45:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
country_id: 1643084
description:
Feb  7 07:45:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
country_id: 2750405
description:
Feb  7 07:45:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
country_id: 1668284
description:
Feb  7 07:45:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.147.244.155
country_id: 587116
description:
[2025-02-07 07:44:43 +0100] info [webmaild] 89.147.244.155 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
country_id: 1269750
description:
Feb  7 07:45:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.16.115
country_id: 2750405
description:
2025-02-07 07:45:05 dovecot_plain authenticator failed for playmail20191.fvds.ru [103.54.16.115]:26208: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-07 07:44:52 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:63190: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  7 07:44:24 ait sshd[1658195]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
country_id: 3703430
description:
Feb  7 07:45:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
country_id: 6252001
description:
Feb  7 07:45:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.216.33.31
country_id: 1269750
description:
2025-02-07 07:45:12 dovecot_plain authenticator failed for ([117.216.33.31]) [117.216.33.31]:46018: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
country_id: 1814991
description:
Feb  7 07:45:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.4.18
country_id: 1880251
description:
2025-02-07 07:45:20 dovecot_login authenticator failed for ([180.129.4.18]) [180.129.4.18]:40074: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
country_id: 1835841
description:
Feb  7 07:45:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
country_id: 2921044
description:
Feb  7 07:45:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
country_id: 1814991
description:
2025-02-07 07:45:33 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:45108: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-02-07 07:45:35 dovecot_login authenticator failed for ([61.186.136.36]) [61.186.136.36]:49210: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 07:45:34 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:52394: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
country_id: 1814991
description:
Feb  7 07:45:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
country_id: 1835841
description:
Feb  7 07:45:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
country_id: 1814991
description:
Feb  7 07:45:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-02-07 07:45:29 dovecot_plain authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:40730: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-07 07:45:33 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:60523: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
country_id: 1835841
description:
2025-02-07 07:45:40 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:54462: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
country_id: 1814991
description:
Feb  7 07:46:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  7 07:45:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
country_id: 1269750
description:
2025-02-07 07:45:34 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:35920: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.167.21.148
country_id: 1835841
description:
Feb  7 07:46:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.167.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
country_id: 99237
description:
Feb  7 07:45:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-02-07 07:45:52 dovecot_plain authenticator failed for (enteless) [65.20.147.45]:48410: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.153.194
country_id: 2017370
description:
Feb  7 07:46:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.153.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
country_id: 1814991
description:
2025-02-07 07:46:15 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:49740: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
country_id: 1814991
description:
2025-02-07 07:46:17 dovecot_login authenticator failed for ([43.143.231.208]) [43.143.231.208]:59052: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.29.87.109
country_id: 1814991
description:
Feb  7 07:45:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.29.87.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.210.10
country_id: 1814991
description:
Feb  7 07:45:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.210.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
country_id: 1819730
description:
2025-02-07 07:45:26 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:29421: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-07 07:45:42 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:57405: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.164.190
country_id: 1880251
description:
Feb  7 07:46:13 ait sshd[1658966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.42.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2025-02-07 07:45:23 dovecot_plain authenticator failed for ([101.13.4.119]) [101.13.4.119]:56562: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
country_id: 1835841
description:
2025-02-07 07:46:21 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:54530: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
country_id: 1814991
description:
Feb  7 07:45:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
country_id: 630336
description:
2025-02-07 07:45:44 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:49323: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
country_id: 1814991
description:
Feb  7 07:46:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
country_id: 1835841
description:
2025-02-07 07:45:58 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:36228: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-07 07:45:23 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:52424: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
country_id: 1814991
description:
2025-02-07 07:45:31 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:64692: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
country_id: 1819730
description:
Feb  7 07:45:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
country_id: 1269750
description:
Feb  7 07:45:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
country_id: 1814991
description:
Feb  7 07:45:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.164.190
country_id: 1880251
description:
Feb  7 07:46:13 ait sshd[1658966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.164.190


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
country_id: 1819730
description:
Feb  7 07:45:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  7 07:45:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
country_id: 630336
description:
Feb  7 07:45:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
country_id: 732800
description:
Feb  7 07:45:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-02-07 07:45:25 dovecot_plain authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:53557: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
country_id: 1814991
description:
2025-02-07 07:45:36 dovecot_plain authenticator failed for mail.toptronicsinc.com [218.4.156.254]:40851: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.156.63.212
country_id: 1880251
description:
Feb  7 07:45:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.156.63.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
country_id: 2921044
description:
2025-02-07 07:45:31 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:53674: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.63.212
country_id: 1880251
description:
2025-02-07 07:45:39 dovecot_plain authenticator failed for ([202.156.63.212]) [202.156.63.212]:34842: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
country_id: 1814991
description:
2025-02-07 07:45:48 dovecot_plain authenticator failed for ([111.39.206.23]) [111.39.206.23]:57276: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
country_id: 1819730
description:
Feb  7 07:45:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
country_id: 3469034
description:
Feb  7 07:45:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.29.87.109
country_id: 1814991
description:
2025-02-07 07:45:28 dovecot_plain authenticator failed for ([112.29.87.109]) [112.29.87.109]:42898: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
country_id: 732800
description:
2025-02-07 07:45:24 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:50759: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
country_id: 1819730
description:
2025-02-07 07:45:53 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:22035: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.153.194
country_id: 2017370
description:
2025-02-07 07:46:06 dovecot_plain authenticator failed for ([95.66.153.194]) [95.66.153.194]:38234: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.156.63.212
country_id: 1880251
description:
Feb  7 07:46:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.156.63.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.132.190
country_id: 1880251
description:
Feb  7 07:46:41 ait sshd[1659173]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.66.132.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.52.97
country_id: 6251999
description:
Feb  7 07:46:42 ait sshd[1659178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.52.97


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
country_id: 2661886
description:
2025-02-07 07:46:49 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:53226: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.242.78
country_id: 1814991
description:
2025-02-07 07:46:55 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:33190: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
country_id: 337996
description:
Feb  7 07:47:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
country_id: 1835841
description:
2025-02-07 07:46:35 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:55688: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.217.130.86
country_id: 3996063
description:
Feb  7 07:46:43 ait sshd[1659180]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.217.130.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.217.130.86
country_id: 3996063
description:
Feb  7 07:46:43 ait sshd[1659180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.217.130.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2025-02-07 07:47:07 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:52500: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
country_id: 1814991
description:
Feb  7 07:46:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  7 07:47:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
country_id: 2510769
description:
2025-02-07 07:46:31 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:42738: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2025-02-07 07:46:47 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:47420: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.242.78
country_id: 1814991
description:
Feb  7 07:46:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.242.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-07 07:47:04 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:51955: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.66.132.190
country_id: 1880251
description:
Feb  7 07:46:41 ait sshd[1659173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.132.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
country_id: 6252001
description:
2025-02-07 07:46:51 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:37363: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
country_id: 2017370
description:
Feb  7 07:47:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
country_id: 2017370
description:
2025-02-07 07:47:06 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:50238: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.29.95
country_id: 1880251
description:
47.128.29.95 - - [07/Feb/2025:07:47:13 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18284437" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.95


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.63.212
country_id: 1880251
description:
2025-02-07 07:46:32 dovecot_plain authenticator failed for ([202.156.63.212]) [202.156.63.212]:54468: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
country_id: 1835841
description:
2025-02-07 07:47:02 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:56474: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
country_id: 2510769
description:
Feb  7 07:46:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.52.97
country_id: 6251999
description:
Feb  7 07:46:42 ait sshd[1659178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.52.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
country_id: 2661886
description:
Feb  7 07:46:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
country_id: 6252001
description:
Feb  7 07:46:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.24
country_id: 289688
description:
2025-02-07 07:46:26 dovecot_login authenticator failed for (ADMIN) [95.181.234.24]:51118: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
country_id: 1835841
description:
Feb  7 07:46:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
country_id: 1835841
description:
Feb  7 07:47:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.157.148
country_id: 3017382
description:
Feb  7 07:47:23 ait sshd[1659409]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.157.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Feb  7 07:47:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  7 07:47:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
country_id: 1269750
description:
Feb  7 07:47:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
country_id: 1269750
description:
2025-02-07 07:47:55 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:38074: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
country_id: 6252001
description:
2025-02-07 07:48:02 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:40744: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
country_id: 6252001
description:
Feb  7 07:48:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 07:47:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.202
country_id: 1819730
description:
Feb  7 07:48:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-02-07 07:47:29 dovecot_plain authenticator failed for ([218.22.187.69]) [218.22.187.66]:53837: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-07 07:47:33 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:58678: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.29.194.144
country_id: 3865483
description:
[2025-02-07 07:47:36 +0100] info [webmaild] 181.29.194.144 - info@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.202
country_id: 1819730
description:
2025-02-07 07:48:17 dovecot_plain authenticator failed for (m121-202-206-202.smartone.com) [121.202.206.202]:35219: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.157.148
country_id: 3017382
description:
Feb  7 07:47:23 ait sshd[1659409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.157.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.215.60
country_id: 1835841
description:
2025-02-07 07:48:29 dovecot_plain authenticator failed for ([175.207.215.60]) [175.207.215.60]:47081: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.157.148
country_id: 3017382
description:
Feb  7 07:49:13 ait sshd[1659909]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.157.148 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.33.148
country_id: 1880251
description:
47.128.33.148 - - [07/Feb/2025:07:49:16 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=1530963" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.215.60
country_id: 1835841
description:
Feb  7 07:48:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.215.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.25.140
country_id: 1880251
description:
47.128.25.140 - - [07/Feb/2025:07:48:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26494493 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?filter_course-language=79%2C183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.25.140


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.157.148
country_id: 3017382
description:
Feb  7 07:49:13 ait sshd[1659909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.157.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.232
country_id: 1269750
description:
Feb  7 07:49:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
country_id: 2750405
description:
2025-02-07 07:49:29 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:55676: 535 Incorrect authentication data (set_id=abuse@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.181.1.49
country_id: 6252001
description:
Feb  7 07:49:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.181.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.138
country_id: 1814991
description:
2025-02-07 07:50:00 dovecot_plain authenticator failed for ([112.91.124.138]) [112.91.124.138]:47685: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
country_id: 3469034
description:
2025-02-07 07:50:00 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:36359: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
country_id: 3469034
description:
Feb  7 07:50:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.232
country_id: 1269750
description:
2025-02-07 07:49:24 dovecot_plain authenticator failed for (abts-ap-dynamic-232.205.169.122.airtelbroadband.in) [122.169.205.232]:56458: 535 Incorrect authentication data (set_id=abuse@ait-ext.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.217.130.86
country_id: 3996063
description:
Feb  7 07:49:31 ait sshd[1660090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.217.130.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
country_id: 3175395
description:
2025-02-07 07:50:10 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:41810: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
country_id: 1835841
description:
2025-02-07 07:50:00 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:57516: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.249.163.4
country_id: 6251999
description:
2025-02-07 07:50:08 dovecot_plain authenticator failed for ([162.249.163.4]) [162.249.163.4]:50499: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
country_id: 1269750
description:
Feb  7 07:50:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.133.6
country_id: 3469034
description:
Feb  7 07:50:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.133.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  7 07:49:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.108
country_id: 1861060
description:
Feb  7 07:49:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
country_id: 1269750
description:
2025-02-07 07:50:13 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:41786: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
country_id: 2017370
description:
2025-02-07 07:50:14 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:59898: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2025-02-07 07:50:18 dovecot_plain authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:39225: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.52.97
country_id: 6251999
description:
Feb  7 07:49:31 ait sshd[1660092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.52.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.108
country_id: 1861060
description:
2025-02-07 07:49:53 dovecot_plain authenticator failed for st7020.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.108]:50574: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-02-07 07:49:58 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:40356: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-07 07:50:05 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:44044: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.249.163.4
country_id: 6251999
description:
Feb  7 07:50:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.249.163.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
country_id: 1814991
description:
2025-02-07 07:50:08 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:12758: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.51.215
country_id: 1269750
description:
Feb  7 07:50:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.51.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.66.132.190
country_id: 1880251
description:
Feb  7 07:49:28 ait sshd[1660080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.132.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-07 07:49:50 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:53244: 535 Incorrect authentication data (set_id=abuse@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
country_id: 6252001
description:
2025-02-07 07:49:53 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:42524: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
country_id: 1269750
description:
Feb  7 07:50:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  7 07:49:29 ait sshd[1660085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
country_id: 6252001
description:
Feb  7 07:49:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.86.87
country_id: 6252001
description:
Feb  7 07:49:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.86.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.86.87
country_id: 6252001
description:
2025-02-07 07:50:00 dovecot_plain authenticator failed for c-73-199-86-87.hsd1.nj.comcast.net (chorminess) [73.199.86.87]:34484: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
country_id: 2750405
description:
Feb  7 07:49:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.22.55
country_id: 3469034
description:
Feb  7 07:49:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.22.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
country_id: 1835841
description:
2025-02-07 07:50:00 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:22010: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.132.190
country_id: 1880251
description:
Feb  7 07:49:28 ait sshd[1660080]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.66.132.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
country_id: 1819730
description:
Feb  7 07:50:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
country_id: 1269750
description:
2025-02-07 07:50:07 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:55352: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.51.215
country_id: 1269750
description:
2025-02-07 07:50:13 dovecot_plain authenticator failed for ([117.242.51.215]) [117.242.51.215]:42313: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.52.97
country_id: 6251999
description:
Feb  7 07:49:31 ait sshd[1660092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.52.97


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
country_id: 3469034
description:
Feb  7 07:49:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.217.130.86
country_id: 3996063
description:
Feb  7 07:49:31 ait sshd[1660090]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.217.130.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.164.190
country_id: 1880251
description:
Feb  7 07:49:38 ait sshd[1660126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.42.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
country_id: 1835841
description:
Feb  7 07:50:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Feb  7 07:49:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.164.190
country_id: 1880251
description:
Feb  7 07:49:38 ait sshd[1660126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.164.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-07 07:49:49 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:58726: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
country_id: 1819730
description:
2025-02-07 07:50:03 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:39555: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.240.110
country_id: 3469034
description:
Feb  7 07:50:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.240.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
country_id: 3469034
description:
2025-02-07 07:50:19 dovecot_login authenticator failed for ([191.241.247.150]) [191.241.247.150]:41564: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-02-07 07:49:32 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:60614: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
country_id: 3469034
description:
2025-02-07 07:49:53 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:52363: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
country_id: 1835841
description:
Feb  7 07:49:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.138
country_id: 1814991
description:
Feb  7 07:49:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
country_id: 3175395
description:
Feb  7 07:50:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
country_id: 2017370
description:
Feb  7 07:50:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.240.110
country_id: 3469034
description:
2025-02-07 07:50:14 dovecot_plain authenticator failed for (187-51-240-110.customer.tdatabrasil.net.br) [187.51.240.110]:53971: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
country_id: 1835841
description:
2025-02-07 07:50:19 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:45290: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  7 07:49:29 ait sshd[1660085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
country_id: 1835841
description:
Feb  7 07:49:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
country_id: 1835841
description:
Feb  7 07:49:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
country_id: 1814991
description:
Feb  7 07:49:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-02-07 07:49:56 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:33721: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.52.97
country_id: 6251999
description:
Feb  7 07:50:42 ait sshd[1660813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.52.97 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 189.217.130.86
country_id: 3996063
description:
Feb  7 07:50:48 ait sshd[1660856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.217.130.86


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.66.132.190
country_id: 1880251
description:
Feb  7 07:51:03 ait sshd[1661047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.132.190


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  7 07:51:09 ait sshd[1661087]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  7 07:51:09 ait sshd[1661087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.157.148
country_id: 3017382
description:
Feb  7 07:50:26 ait sshd[1660548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.157.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 07:50:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.52.97
country_id: 6251999
description:
Feb  7 07:50:42 ait sshd[1660813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.52.97


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
country_id: 290557
description:
2025-02-07 07:50:32 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:55259: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.136.193.248
country_id: 2510769
description:
Feb  7 07:50:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.136.193.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.157.148
country_id: 3017382
description:
Feb  7 07:50:26 ait sshd[1660548]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.157.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
country_id: 290557
description:
Feb  7 07:50:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.132.190
country_id: 1880251
description:
Feb  7 07:51:03 ait sshd[1661047]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.66.132.190 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.157.148
country_id: 3017382
description:
Feb  7 07:50:28 ait sshd[1660548]: Failed password for invalid user steam from 146.59.157.148 port 42534 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
country_id: 1819730
description:
Feb  7 07:50:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
country_id: 1819730
description:
2025-02-07 07:50:53 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:42712: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.193.248
country_id: 2510769
description:
2025-02-07 07:50:27 dovecot_login authenticator failed for (248-193-136-45.ddns.movitel.tv) [45.136.193.248]:57052: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.217.130.86
country_id: 3996063
description:
Feb  7 07:50:48 ait sshd[1660856]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.217.130.86 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-52.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
country_id: 6252001
description:
Feb  7 07:52:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.164.190
country_id: 1880251
description:
Feb  7 07:52:05 ait sshd[1661502]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.42.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
country_id: 6252001
description:
2025-02-07 07:52:07 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:39734: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.109.1.49
country_id: 1814991
description:
Feb  7 07:52:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.109.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.164.190
country_id: 1880251
description:
Feb  7 07:52:05 ait sshd[1661502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.164.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.109.1.49
country_id: 1814991
description:
2025-02-07 07:52:23 dovecot_login authenticator failed for ([182.109.1.49]) [182.109.1.49]:40516: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.89.39.186
country_id: 2921044
description:
Feb  7 07:52:45 ait sshd[1661855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.89.39.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.89.39.186
country_id: 2921044
description:
Feb  7 07:52:45 ait sshd[1661855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.89.39.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
country_id: 1814991
description:
Feb  7 07:53:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 07:54:02 ait sshd[1662258]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.41.9
country_id: 3658394
description:
[2025-02-07 07:54:13 +0100] info [webmaild] 191.99.41.9 - info@jaster.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
country_id: 1835841
description:
Feb  7 07:54:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
country_id: 1835841
description:
2025-02-07 07:54:08 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:37486: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.188.78.64
country_id: 6252001
description:
Feb  7 07:54:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.188.78.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.188.78.64
country_id: 6252001
description:
2025-02-07 07:54:12 dovecot_plain authenticator failed for ool-18bc4e40.dyn.optonline.net [24.188.78.64]:34579: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
country_id: 1814991
description:
2025-02-07 07:53:52 dovecot_plain authenticator failed for ([220.248.205.15]) [220.248.205.14]:1393: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 07:54:02 ait sshd[1662258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.12.229
country_id: 1835841
description:
2025-02-07 07:54:54 dovecot_plain authenticator failed for ([221.162.12.229]) [221.162.12.229]:37964: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.142.8
country_id: 2017370
description:
2025-02-07 07:55:15 dovecot_plain authenticator failed for 95-165-142-8.static.spd-mgts.ru [95.165.142.8]:56127: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
country_id: 1814991
description:
2025-02-07 07:54:28 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:35212: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 07:54:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Feb  7 07:55:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-07 07:55:04 dovecot_plain authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:57164: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.142.8
country_id: 2017370
description:
Feb  7 07:55:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.142.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
country_id: 1814991
description:
Feb  7 07:54:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.12.229
country_id: 1835841
description:
Feb  7 07:54:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.12.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
country_id: 3017382
description:
2025-02-07 07:55:31 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:49886: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
country_id: 6252001
description:
2025-02-07 07:56:03 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:40296: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: ijbit.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-56.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  7 07:56:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-07 07:56:17 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:10429: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
country_id: 3017382
description:
Feb  7 07:55:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: ijari.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-55.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
country_id: 6252001
description:
Feb  7 07:56:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
country_id: 1835841
description:
Feb  7 07:56:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.15.177.173
country_id: 1814991
description:
2025-02-07 07:56:48 dovecot_plain authenticator failed for ([121.15.177.173]) [121.15.177.173]:49994: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 07:56:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-02-07 07:57:03 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:49918: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.89.157
country_id: 1835841
description:
Feb  7 07:56:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.89.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.15.177.173
country_id: 1814991
description:
Feb  7 07:56:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.15.177.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-02-07 07:56:46 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:20848: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
country_id: 1668284
description:
Feb  7 07:57:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.89.157
country_id: 1835841
description:
2025-02-07 07:56:33 dovecot_plain authenticator failed for ([121.167.89.157]) [121.167.89.157]:43627: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
country_id: 2661886
description:
2025-02-07 07:57:38 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:37000: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
country_id: 1814991
description:
2025-02-07 07:57:56 dovecot_plain authenticator failed for ([180.104.103.146]) [180.104.103.146]:59156: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
country_id: 1269750
description:
2025-02-07 07:58:09 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:44825: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
country_id: 1814991
description:
2025-02-07 07:58:15 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:28444: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
country_id: 1814991
description:
2025-02-07 07:58:15 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:52826: 535 Incorrect authentication data (set_id=abuse@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.112.159
country_id: 2661886
description:
Feb  7 07:57:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.112.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
country_id: 1814991
description:
Feb  7 07:57:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
country_id: 1814991
description:
Feb  7 07:57:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
country_id: 3932488
description:
Feb  7 07:57:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
country_id: 1814991
description:
2025-02-07 07:58:06 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:52254: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-07 07:58:17 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:40080: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-02-07 07:58:01 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:43875: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
country_id: 1814991
description:
Feb  7 07:58:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
country_id: 1814991
description:
Feb  7 07:58:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.69.46.148
country_id: 1168579
description:
Feb  7 07:58:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.69.46.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-07 07:57:53 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:35138: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
country_id: 1269750
description:
Feb  7 07:58:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
country_id: 1814991
description:
Feb  7 07:58:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  7 07:58:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  7 07:58:35 ait sshd[1664049]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  7 07:58:35 ait sshd[1664049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  7 07:58:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.252
country_id: 1814991
description:
2025-02-07 07:58:29 dovecot_plain authenticator failed for ([183.220.241.252]) [183.220.241.252]:57266: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
country_id: 1835841
description:
2025-02-07 07:58:33 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:55739: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-07 07:58:58 dovecot_plain authenticator failed for (ingion) [64.72.74.162]:38471: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.241.252
country_id: 1814991
description:
Feb  7 07:58:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.241.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
country_id: 1835841
description:
Feb  7 07:58:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.69.46.148
country_id: 1168579
description:
2025-02-07 07:58:23 dovecot_plain authenticator failed for ([202.69.46.148]) [202.69.46.148]:34056: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.123.7.216
country_id: 1168579
description:
[2025-02-07 07:59:23 +0100] info [webmaild] 223.123.7.216 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
country_id: 3932488
description:
Feb  7 07:59:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-02-07 07:59:50 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:45394: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.174.209.160
country_id: 1814991
description:
2025-02-07 08:00:07 dovecot_plain authenticator failed for ([220.174.209.156]) [220.174.209.160]:52968: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
country_id: 1835841
description:
2025-02-07 08:00:42 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:43960: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 08:01:11 ait sshd[1665074]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 08:01:11 ait sshd[1665074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  7 08:00:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-07 08:00:27 dovecot_plain authenticator failed for ([178.178.222.55]) [178.178.222.55]:54844: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
country_id: 1835841
description:
Feb  7 08:00:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
country_id: 2510769
description:
2025-02-07 08:01:28 dovecot_plain authenticator failed for (unquads) [207.188.157.230]:23054: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-07 08:01:38 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:37515: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
country_id: 2510769
description:
Feb  7 08:01:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
country_id: 1814991
description:
2025-02-07 08:01:27 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:52521: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.253.194.29
country_id: 1814991
description:
Feb  7 08:02:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.253.194.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.253.194.29
country_id: 1814991
description:
2025-02-07 08:02:10 dovecot_plain authenticator failed for ([58.253.194.29]) [58.253.194.29]:40574: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.169.152.103
country_id: 1835841
description:
2025-02-07 08:02:12 dovecot_plain authenticator failed for ([192.168.10.18]) [112.169.152.103]:59802: 535 Incorrect authentication data (set_id=ads19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
country_id: 1814991
description:
Feb  7 08:01:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  7 08:01:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
country_id: 1814991
description:
Feb  7 08:01:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2025-02-07 08:01:56 dovecot_plain authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:53887: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.169.152.103
country_id: 1835841
description:
Feb  7 08:02:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.169.152.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
country_id: 1814991
description:
Feb  7 08:03:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
country_id: 1814991
description:
2025-02-07 08:03:16 dovecot_login authenticator failed for ([39.88.252.16]) [39.88.252.16]:53036: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.89
country_id: 660013
description:
2025-02-07 08:02:44 dovecot_login authenticator failed for (ADMIN) [188.126.89.89]:59474: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  7 08:03:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-07 08:03:07 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:48209: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.202.159.233
country_id: 6252001
description:
Feb  7 08:03:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.202.159.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.202.159.233
country_id: 6252001
description:
2025-02-07 08:03:10 dovecot_plain authenticator failed for ec2-52-202-159-233.compute-1.amazonaws.com [52.202.159.233]:41250: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.174.209.160
country_id: 1814991
description:
Feb  7 08:03:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.174.209.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
country_id: 1269750
description:
Feb  7 08:04:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
country_id: 6252001
description:
Feb  7 08:04:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
country_id: 1814991
description:
Feb  7 08:04:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-07 08:04:21 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:55654: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.188.78.64
country_id: 6252001
description:
2025-02-07 08:03:43 dovecot_plain authenticator failed for ool-18bc4e40.dyn.optonline.net [24.188.78.64]:44209: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-02-07 08:03:54 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:45448: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.174.209.160
country_id: 1814991
description:
2025-02-07 08:04:00 dovecot_login authenticator failed for ([220.174.209.156]) [220.174.209.160]:55642: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
country_id: 2017370
description:
Feb  7 08:04:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
country_id: 99237
description:
Feb  7 08:04:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.219.181.96
country_id: 1269750
description:
2025-02-07 08:03:26 dovecot_login authenticator failed for ([117.219.181.96]) [117.219.181.96]:55358: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-02-07 08:04:10 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:41342: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-02-07 08:04:20 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:35870: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
country_id: 1835841
description:
Feb  7 08:03:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
country_id: 1835841
description:
Feb  7 08:03:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
country_id: 597427
description:
Feb  7 08:04:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
country_id: 2017370
description:
2025-02-07 08:04:19 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:60956: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
country_id: 3469034
description:
2025-02-07 08:04:21 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:11372: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
country_id: 2017370
description:
Feb  7 08:03:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-07 08:04:01 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:59082: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
country_id: 6252001
description:
2025-02-07 08:04:12 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:45254: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  7 08:04:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
country_id: 1835841
description:
2025-02-07 08:03:26 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:57310: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-07 08:03:53 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:51678: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.172.24
country_id: 99237
description:
2025-02-07 08:03:54 dovecot_plain authenticator failed for (wayandelte) [65.20.172.24]:53834: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.27
country_id: 1814991
description:
Feb  7 08:04:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.23.77.27
country_id: 1814991
description:
2025-02-07 08:04:11 dovecot_login authenticator failed for ([14.23.77.27]) [14.23.77.27]:45269: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  7 08:03:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
country_id: 1835841
description:
Feb  7 08:04:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
country_id: 3469034
description:
Feb  7 08:04:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.188.78.64
country_id: 6252001
description:
Feb  7 08:03:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.188.78.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
country_id: 2017370
description:
2025-02-07 08:03:48 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:51882: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.24
country_id: 99237
description:
Feb  7 08:03:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
country_id: 597427
description:
2025-02-07 08:04:20 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:48279: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.219.181.96
country_id: 1269750
description:
Feb  7 08:03:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.219.181.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
country_id: 3658394
description:
2025-02-07 08:04:26 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:59752: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
country_id: 1819730
description:
2025-02-07 08:04:28 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:26744: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
country_id: 1269750
description:
Feb  7 08:04:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
country_id: 3144096
description:
2025-02-07 08:04:33 dovecot_plain authenticator failed for (ip-199-1-248-87.eidsiva.net) [87.248.1.199]:46193: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  7 08:04:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
country_id: 6252001
description:
2025-02-07 08:04:40 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:48574: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
country_id: 1835841
description:
2025-02-07 08:04:44 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:60326: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.70.38
country_id: 1814991
description:
2025-02-07 08:04:24 dovecot_plain authenticator failed for ([218.108.70.38]) [218.108.70.38]:56818: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
country_id: 1835841
description:
2025-02-07 08:04:45 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:59724: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
country_id: 1814991
description:
2025-02-07 08:04:24 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:54582: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
country_id: 1814991
description:
2025-02-07 08:04:25 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:48772: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.54.87
country_id: 1814991
description:
Feb  7 08:04:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.54.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.54.87
country_id: 1814991
description:
2025-02-07 08:04:29 dovecot_plain authenticator failed for ([120.237.54.87]) [120.237.54.87]:47226: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-02-07 08:04:31 dovecot_plain authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:37707: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
country_id: 3144096
description:
Feb  7 08:04:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.117.118
country_id: 6252001
description:
2025-02-07 08:04:36 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:39977: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
country_id: 1835841
description:
Feb  7 08:04:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
country_id: 6252001
description:
Feb  7 08:04:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
country_id: 1814991
description:
2025-02-07 08:04:44 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:39974: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.123.153.214
country_id: 1814991
description:
Feb  7 08:05:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.123.153.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
country_id: 1835841
description:
Feb  7 08:04:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
country_id: 3658394
description:
Feb  7 08:04:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.158.175
country_id: 294640
description:
2025-02-07 08:04:33 dovecot_plain authenticator failed for ([195.133.158.175]) [195.133.158.175]:56036: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.26.250
country_id: 3469034
description:
Feb  7 08:04:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.26.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
country_id: 1814991
description:
Feb  7 08:04:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
country_id: 1835841
description:
Feb  7 08:04:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.87.230
country_id: 1814991
description:
2025-02-07 08:05:04 dovecot_plain authenticator failed for ([1.31.87.230]) [1.31.87.230]:35304: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-02-07 08:04:22 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:38122: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
country_id: 337996
description:
Feb  7 08:04:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-07 08:04:34 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:40580: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.56.107.53
country_id: 3469034
description:
2025-02-07 08:04:42 dovecot_plain authenticator failed for ([191.56.107.53]) [191.56.107.53]:40554: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
country_id: 6252001
description:
2025-02-07 08:04:43 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:52714: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.37.54
country_id: 1819730
description:
Feb  7 08:04:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.37.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
country_id: 1835841
description:
2025-02-07 08:04:25 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:52320: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
country_id: 1819730
description:
Feb  7 08:04:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  7 08:04:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-02-07 08:04:34 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:58327: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.196
country_id: 294640
description:
Feb  7 08:04:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.74.187
country_id: 1269750
description:
Feb  7 08:04:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.74.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.87.52
country_id: 3469034
description:
[2025-02-07 08:04:57 +0100] info [webmaild] 177.66.87.52 - info@ait.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-07 08:04:23 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:38332: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-02-07 08:05:19 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:26168: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.84
country_id: 1819730
description:
Feb  7 08:05:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.108.12
country_id: 1814991
description:
2025-02-07 08:04:55 dovecot_plain authenticator failed for ([112.27.108.12]) [112.27.108.12]:38532: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
country_id: 2017370
description:
Feb  7 08:04:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
country_id: 1269750
description:
2025-02-07 08:04:43 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:42799: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
country_id: 1814991
description:
Feb  7 08:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.99
country_id: 895949
description:
2025-02-07 08:04:25 dovecot_plain authenticator failed for (ppp99-lumwana.zamnet.zm) [196.46.199.99]:37673: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Feb  7 08:04:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
country_id: 6252001
description:
Feb  7 08:04:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
country_id: 1835841
description:
2025-02-07 08:04:42 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:38778: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
country_id: 1835841
description:
Feb  7 08:04:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
country_id: 1835841
description:
Feb  7 08:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
country_id: 1814991
description:
2025-02-07 08:04:23 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:25863: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
country_id: 1835841
description:
2025-02-07 08:04:24 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:49786: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.117.118
country_id: 6252001
description:
Feb  7 08:04:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
country_id: 2017370
description:
2025-02-07 08:04:37 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:46352: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.108.12
country_id: 1814991
description:
Feb  7 08:04:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.108.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
country_id: 3469034
description:
Feb  7 08:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.37.54
country_id: 1819730
description:
2025-02-07 08:04:28 dovecot_plain authenticator failed for 054.37.246.220.static.netvigator.com [220.246.37.54]:64433: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
country_id: 1835841
description:
Feb  7 08:04:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.153.214
country_id: 1814991
description:
2025-02-07 08:05:08 dovecot_plain authenticator failed for ([144.123.153.214]) [144.123.153.214]:48952: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
country_id: 1814991
description:
Feb  7 08:04:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2025-02-07 08:04:39 dovecot_plain authenticator failed for (2-55-85-196.orange.net.il) [2.55.85.196]:52394: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.26.250
country_id: 3469034
description:
2025-02-07 08:04:40 dovecot_plain authenticator failed for (201-28-26-250.customer.tdatabrasil.net.br) [201.28.26.250]:44185: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.59
country_id: 597427
description:
2025-02-07 08:04:42 dovecot_login authenticator failed for (ADMIN) [194.32.122.59]:43914: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  7 08:04:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  7 08:04:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-02-07 08:04:35 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:34238: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2025-02-07 08:04:40 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:37828: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.99
country_id: 895949
description:
Feb  7 08:04:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
country_id: 337996
description:
2025-02-07 08:04:32 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:54150: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-07 08:04:39 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:44888: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
country_id: 1210997
description:
Feb  7 08:04:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Feb  7 08:04:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
country_id: 1835841
description:
2025-02-07 08:04:49 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:56646: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.87.230
country_id: 1814991
description:
Feb  7 08:05:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.87.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
country_id: 3469034
description:
2025-02-07 08:04:25 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:40920: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
country_id: 6252001
description:
Feb  7 08:04:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-07 08:04:28 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:49061: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.158.175
country_id: 294640
description:
Feb  7 08:04:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.158.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-02-07 08:04:36 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:52211: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.56.107.53
country_id: 3469034
description:
Feb  7 08:04:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.56.107.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.70.38
country_id: 1814991
description:
Feb  7 08:04:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.70.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
country_id: 6252001
description:
Feb  7 08:05:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.129.200.113
country_id: 2077456
description:
Feb  7 08:06:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.129.200.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 08:05:37 ait sshd[1667023]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.245.120
country_id: 1814991
description:
Feb  7 08:05:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.245.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 08:05:37 ait sshd[1667023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 08:06:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.108
country_id: 1861060
description:
2025-02-07 08:06:13 dovecot_plain authenticator failed for st7020.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.108]:57126: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.245.120
country_id: 1814991
description:
2025-02-07 08:05:40 dovecot_plain authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:54039: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
country_id: 6252001
description:
2025-02-07 08:05:58 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:39185: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.108
country_id: 1861060
description:
Feb  7 08:06:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.200.113
country_id: 2077456
description:
2025-02-07 08:06:15 dovecot_plain authenticator failed for (115-129-200-113.tpgi.com.au) [115.129.200.113]:48728: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.28.145
country_id: 1668284
description:
Feb  7 08:06:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.28.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.145
country_id: 1668284
description:
2025-02-07 08:06:18 dovecot_plain authenticator failed for 111-70-28-145.emome-ip.hinet.net [111.70.28.145]:47406: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
country_id: 1814991
description:
2025-02-07 08:06:28 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:44727: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-07 08:06:28 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:47078: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  7 08:06:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 08:06:26 ait sshd[1667299]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  7 08:06:26 ait sshd[1667299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.32.104
country_id: 1269750
description:
Feb  7 08:06:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.32.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.241.177
country_id: 2017370
description:
Feb  7 08:06:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.241.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
country_id: 1814991
description:
Feb  7 08:06:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-02-07 08:06:39 dovecot_plain authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:65196: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
country_id: 2017370
description:
2025-02-07 08:06:39 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:58112: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
country_id: 1814991
description:
Feb  7 08:06:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
country_id: 1814991
description:
2025-02-07 08:06:54 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:16968: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-07.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 08:07:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
country_id: 1269750
description:
Feb  7 08:09:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
country_id: 1821275
description:
2025-02-07 08:09:11 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:59706: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
country_id: 1814991
description:
Feb  7 08:09:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
country_id: 3469034
description:
Feb  7 08:09:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-02-07 08:09:21 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:44678: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
country_id: 2661886
description:
Feb  7 08:09:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  7 08:09:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
country_id: 2328926
description:
Feb  7 08:09:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
country_id: 1819730
description:
Feb  7 08:09:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
country_id: 953987
description:
2025-02-07 08:09:10 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:53760: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
country_id: 2328926
description:
2025-02-07 08:09:10 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:44814: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-02-07 08:09:13 dovecot_plain authenticator failed for ([203.193.137.250]) [203.193.137.250]:65185: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
country_id: 2661886
description:
2025-02-07 08:09:08 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:57667: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2025-02-07 08:09:14 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:33594: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
country_id: 99237
description:
Feb  7 08:09:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
country_id: 1814991
description:
2025-02-07 08:09:13 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:57740: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
country_id: 953987
description:
Feb  7 08:09:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-07 08:09:09 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:46260: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
country_id: 1819730
description:
2025-02-07 08:09:11 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:30261: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
country_id: 1821275
description:
Feb  7 08:09:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
country_id: 1814991
description:
Feb  7 08:09:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
country_id: 1814991
description:
Feb  7 08:09:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-07 08:09:36 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:57848: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
country_id: 1821275
description:
2025-02-07 08:09:40 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:42816: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
country_id: 1814991
description:
2025-02-07 08:09:56 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:52585: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
country_id: 1835841
description:
Feb  7 08:09:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
country_id: 3017382
description:
2025-02-07 08:09:41 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:49716: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
country_id: 3469034
description:
2025-02-07 08:09:23 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:57684: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
country_id: 1819730
description:
Feb  7 08:09:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2025-02-07 08:09:26 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:57619: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  7 08:09:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.20.180
country_id: 1562822
description:
2025-02-07 08:09:38 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:54179: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
country_id: 2661886
description:
Feb  7 08:09:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
country_id: 298795
description:
2025-02-07 08:09:28 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:53110: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
country_id: 1821275
description:
Feb  7 08:09:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
country_id: 2328926
description:
Feb  7 08:09:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
country_id: 298795
description:
Feb  7 08:09:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
country_id: 1835841
description:
2025-02-07 08:09:34 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:37860: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.20.180
country_id: 1562822
description:
Feb  7 08:09:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.20.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
country_id: 1835841
description:
2025-02-07 08:09:38 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:35666: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
country_id: 2661886
description:
2025-02-07 08:09:57 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (detitow) [217.215.254.115]:54844: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
country_id: 1814991
description:
Feb  7 08:09:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
country_id: 1819730
description:
2025-02-07 08:09:28 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:62704: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
country_id: 1814991
description:
2025-02-07 08:09:29 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:55989: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
country_id: 1835841
description:
Feb  7 08:09:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
country_id: 3017382
description:
Feb  7 08:09:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
country_id: 1814991
description:
Feb  7 08:09:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
country_id: 2328926
description:
2025-02-07 08:09:27 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:55434: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
country_id: 630336
description:
2025-02-07 08:11:17 dovecot_plain authenticator failed for ([91.149.142.21]) [91.149.142.21]:41031: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.200.243
country_id: 3469034
description:
[2025-02-07 08:10:40 +0100] info [webmaild] 177.38.200.243 - info@ait-edu.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 08:10:58 ait sshd[1669029]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.150.115
country_id: 1819730
description:
Feb  7 08:11:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.150.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
country_id: 1814991
description:
2025-02-07 08:11:09 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:46712: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 154.161.105.208
country_id: 2300660
domain: smartsis.ait-ext.com
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/admin/includes/academicyear.inc.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
country_id: 630336
description:
Feb  7 08:11:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
country_id: 1835841
description:
Feb  7 08:10:58 ait sshd[1669029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
country_id: 1814991
description:
Feb  7 08:11:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-02-07 08:11:07 dovecot_plain authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:57257: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
country_id: 1814991
description:
Feb  7 08:11:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 08:11:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


