# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.143.132.60
description:
[2025-02-04 23:38:18 +0100] info [webmaild] 192.143.132.60 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Feb  4 23:38:28 ait sshd[219397]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.94.154.7
description:
[2025-02-04 23:38:15 +0100] info [webmaild] 201.94.154.7 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  4 23:38:28 ait sshd[219397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.223.190
description:
[2025-02-04 23:37:44 +0100] info [webmaild] 45.227.223.190 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.232.19.79
description:
Feb  4 23:37:43 ait sshd[219241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.232.19.79


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.232.19.79
description:
Feb  4 23:37:43 ait sshd[219241]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.232.19.79 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.46.201
description:
47.128.46.201 - - [04/Feb/2025:23:38:07 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9847727" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.201


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
description:
Feb  4 23:38:13 ait sshd[219354]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
description:
Feb  4 23:37:45 ait sshd[219276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
description:
Feb  4 23:37:45 ait sshd[219276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
description:
Feb  4 23:38:13 ait sshd[219354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.236.214
description:
Feb  4 23:38:18 ait sshd[219382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.236.214


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 23:38:34 ait sshd[219432]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  4 23:39:02 ait sshd[219634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-02-04 23:39:18 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:38802: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.11.249
description:
Feb  4 23:39:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.11.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 23:38:34 ait sshd[219432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  4 23:39:02 ait sshd[219634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.87.98.82
description:
[2025-02-04 23:38:48 +0100] info [webmaild] 187.87.98.82 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Feb  4 23:39:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 23:38:34 ait sshd[219432]: Invalid user ergotherapie-hattinger.at 2a01 from 122.51.104.242 port 43286


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
description:
Feb  4 23:40:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.133.214.161
description:
Feb  4 23:40:29 ait sshd[220272]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.133.214.161 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.133.214.161
description:
Feb  4 23:40:29 ait sshd[220272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.214.161  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
description:
2025-02-04 23:40:29 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:57331: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 23:40:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.36.239
description:
[2025-02-04 23:40:22 +0100] info [webmaild] 190.114.36.239 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 23:40:17 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:40478: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.11.249
description:
2025-02-04 23:39:32 dovecot_plain authenticator failed for ([202.179.85.98]) [103.207.11.249]:41261: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 65.21.58.141
description:
Feb  4 23:40:54 ait sshd[220574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.21.58.141


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 23:40:55 ait sshd[220570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.23
description:
2025-02-04 23:40:55 dovecot_login authenticator failed for ([188.59.178.23]) [188.59.178.23]:36082: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.218
description:
47.128.59.218 - - [04/Feb/2025:23:40:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13628596 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/open/index.php?Itemid=388&id=311&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.218


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
description:
2025-02-04 23:40:45 dovecot_login authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:58077: 535 Incorrect authentication data (set_id=mail@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 23:40:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.70.34
description:
[2025-02-04 23:40:52 +0100] info [webmaild] 37.77.70.34 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.15.163.18
description:
Feb  4 23:41:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.15.163.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
description:
2025-02-04 23:41:27 dovecot_plain authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:64579: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
description:
Feb  4 23:40:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.23
description:
Feb  4 23:40:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 23:40:55 ait sshd[220570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.201.58.193
description:
[2025-02-04 23:40:58 +0100] info [webmaild] 109.201.58.193 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  4 23:41:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-04 23:41:38 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:42416: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
description:
Feb  4 23:41:42 ait sshd[220719]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.153.68.238
description:
Feb  4 23:42:27 ait sshd[220988]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.153.68.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.17.139.76
description:
[2025-02-04 23:41:33 +0100] info [webmaild] 177.17.139.76 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.153.68.238
description:
Feb  4 23:42:27 ait sshd[220988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.153.68.238  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
description:
Feb  4 23:41:42 ait sshd[220719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215  user=bin


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
description:
Feb  4 23:42:03 ait sshd[220910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
description:
Feb  4 23:42:29 ait sshd[220993]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
description:
Feb  4 23:42:29 ait sshd[220993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.49.208.107
description:
[2025-02-04 23:43:04 +0100] info [webmaild] 187.49.208.107 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Feb  4 23:43:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-02-04 23:43:27 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:52434: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-04 23:42:53 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:58589: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
description:
Feb  4 23:43:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  4 23:42:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  4 23:43:11 ait sshd[221234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
description:
2025-02-04 23:43:15 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:43314: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-02-04 23:43:59 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:63248: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.133.32
description:
[2025-02-04 23:43:34 +0100] info [webmaild] 160.238.133.32 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.113.230
description:
[2025-02-04 23:43:36 +0100] info [webmaild] 176.29.113.230 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
description:
Feb  4 23:43:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
description:
2025-02-04 23:43:45 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:60090: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Feb  4 23:43:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.191.8.167
description:
[2025-02-04 23:44:11 +0100] info [webmaild] 179.191.8.167 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
description:
Feb  4 23:44:17 ait sshd[221666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 23:45:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-45.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  4 23:45:49 ait sshd[222394]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.37.213
description:
[2025-02-04 23:45:38 +0100] info [webmaild] 191.5.37.213 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
description:
Feb  4 23:46:08 ait sshd[222593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
description:
Feb  4 23:46:08 ait sshd[222593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.50.72.171
description:
[2025-02-04 23:46:17 +0100] info [webmaild] 201.50.72.171 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
description:
2025-02-04 23:46:21 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:45585: 535 Incorrect authentication data (set_id=mail@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.18.139.82
description:
Feb  4 23:46:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.18.139.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.76.161.99
description:
Feb  4 23:46:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.76.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
description:
Feb  4 23:46:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.76.161.99
description:
2025-02-04 23:46:20 dovecot_plain authenticator failed for (expalkale) [80.76.161.99]:59412: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
description:
Feb  4 23:45:39 ait sshd[222265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  4 23:45:49 ait sshd[222394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223  user=bin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  4 23:46:06 ait sshd[222579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  4 23:46:06 ait sshd[222579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.122.196
description:
[2025-02-04 23:46:08 +0100] info [webmaild] 170.231.122.196 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
description:
Feb  4 23:45:39 ait sshd[222265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=bin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-02-04 23:46:31 dovecot_login authenticator failed for ([60.18.139.82]) [60.18.139.82]:58780: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  4 23:46:40 ait sshd[222655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.101.26
description:
[2025-02-04 23:46:51 +0100] info [webmaild] 177.104.101.26 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
description:
Feb  4 23:47:19 ait sshd[222917]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
description:
Feb  4 23:47:03 ait sshd[222824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.7.109.160
description:
Feb  4 23:47:13 ait sshd[222894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.7.109.160


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  4 23:47:00 ait sshd[222791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
description:
Feb  4 23:47:03 ait sshd[222824]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
description:
Feb  4 23:47:19 ait sshd[222917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 161.248.188.75
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:23-46.161.248.188.75


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  4 23:46:40 ait sshd[222655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.7.109.160
description:
Feb  4 23:47:13 ait sshd[222894]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.7.109.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.174.206.158
description:
[2025-02-04 23:48:18 +0100] info [webmaild] 85.174.206.158 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
description:
Feb  4 23:48:08 ait sshd[223203]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
description:
Feb  4 23:48:08 ait sshd[223203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215  user=bin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  4 23:48:09 ait sshd[223207]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  4 23:48:09 ait sshd[223207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  4 23:47:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-02-04 23:47:49 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (tomensante) [89.153.62.100]:60648: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.228
description:
Feb  4 23:48:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.228
description:
2025-02-04 23:48:31 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:54017: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  4 23:48:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Feb  4 23:49:11 ait sshd[223569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=lemsas


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Feb  4 23:49:11 ait sshd[223569]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
description:
Feb  4 23:49:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-02-04 23:49:14 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:40260: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-02-04 23:49:25 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:48518: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.48.49
description:
[2025-02-04 23:48:50 +0100] info [webmaild] 45.5.48.49 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.194.180
description:
[2025-02-04 23:48:51 +0100] info [webmaild] 45.187.194.180 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
description:
Feb  4 23:48:52 ait sshd[223372]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  4 23:48:52 ait sshd[223372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 23:48:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-04 23:49:00 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:45942: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Feb  4 23:49:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  4 23:50:21 ait sshd[224134]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.254.47.119
description:
[2025-02-04 23:49:52 +0100] info [webmaild] 179.254.47.119 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.205
description:
[2025-02-04 23:49:55 +0100] info [cpaneld] 156.228.93.205 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-02-04 23:50:06 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:41129: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.92.201
description:
[2025-02-04 23:50:04 +0100] info [whostmgrd] 156.228.92.201 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.121.193.191
description:
Feb  4 23:50:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.121.193.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  4 23:49:35 ait sshd[223630]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.43
description:
[2025-02-04 23:49:43 +0100] info [cpaneld] 104.207.45.43 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
description:
2025-02-04 23:49:55 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:59854: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
description:
Feb  4 23:50:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.158
description:
[2025-02-04 23:50:26 +0100] info [whostmgrd] 156.228.81.158 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.211
description:
[2025-02-04 23:50:14 +0100] info [whostmgrd] 154.214.1.211 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.171
description:
[2025-02-04 23:50:23 +0100] info [whostmgrd] 156.228.117.171 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
description:
Feb  4 23:49:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.4
description:
[2025-02-04 23:50:00 +0100] info [cpaneld] 104.207.36.4 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.205
description:
[2025-02-04 23:50:07 +0100] info [whostmgrd] 156.228.106.205 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.121.193.191
description:
2025-02-04 23:50:08 dovecot_plain authenticator failed for syn-070-121-193-191.res.spectrum.com [70.121.193.191]:51946: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.88.21
description:
[2025-02-04 23:50:11 +0100] info [whostmgrd] 156.228.88.21 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  4 23:50:21 ait sshd[224134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  4 23:49:35 ait sshd[223630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177  user=lemsas


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.14
description:
[2025-02-04 23:49:46 +0100] info [cpaneld] 156.228.99.14 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.217
description:
[2025-02-04 23:49:49 +0100] info [cpaneld] 156.228.96.217 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.208.184
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:23-50.3.109.208.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-02-04 23:51:25 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:60562: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
description:
2025-02-04 23:50:35 dovecot_plain authenticator failed for ([91.244.113.178]) [91.244.113.178]:49250: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.93.191.180
description:
Feb  4 23:50:39 ait sshd[224335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.191.180  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.143
description:
2025-02-04 23:51:04 dovecot_login authenticator failed for (q6UOQhu8) [45.154.98.143]:10529: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.239.243.163
description:
[2025-02-04 23:50:53 +0100] info [webmaild] 188.239.243.163 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
description:
Feb  4 23:51:09 ait sshd[224513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66  user=bin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Feb  4 23:51:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.244.113.178
description:
Feb  4 23:50:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.244.113.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.143
description:
Feb  4 23:51:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
description:
Feb  4 23:51:09 ait sshd[224513]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.109.76.38
description:
[2025-02-04 23:51:25 +0100] info [webmaild] 190.109.76.38 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.145.202
description:
Feb  4 23:50:58 ait sshd[224470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.145.202


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.191.180
description:
Feb  4 23:50:39 ait sshd[224335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.93.191.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.194.173
description:
[2025-02-04 23:51:34 +0100] info [webmaild] 45.161.194.173 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.143
description:
Feb  4 23:51:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-02-04 23:51:33 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:59018: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-02-04 23:51:44 dovecot_login authenticator failed for ([118.218.10.21]) [118.218.10.21]:39427: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.169.42.135
description:
2025-02-04 23:52:09 dovecot_plain authenticator failed for ([45.169.42.135]) [45.169.42.135]:57807: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  4 23:52:20 ait sshd[224950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102  user=bin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
description:
Feb  4 23:51:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.143
description:
2025-02-04 23:51:32 dovecot_login authenticator failed for (lKzOt7zYuW) [45.154.98.143]:1966: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-02-04 23:51:38 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:47678: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Feb  4 23:51:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.19.211.4
description:
Feb  4 23:51:46 ait sshd[224678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.19.211.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.169.42.135
description:
Feb  4 23:52:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.169.42.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  4 23:52:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  4 23:52:20 ait sshd[224950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
description:
Feb  4 23:51:48 ait sshd[224683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.194.16.117
description:
[2025-02-04 23:52:06 +0100] info [webmaild] 177.194.16.117 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
description:
Feb  4 23:52:07 ait sshd[224913]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
description:
Feb  4 23:51:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
description:
Feb  4 23:51:48 ait sshd[224683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
description:
Feb  4 23:52:07 ait sshd[224913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.19.211.4
description:
Feb  4 23:51:46 ait sshd[224678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.19.211.4  user=lemsas


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-04 23:52:11 dovecot_login authenticator failed for ([222.236.59.174]) [222.236.59.174]:45246: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  4 23:52:13 ait sshd[224924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  4 23:52:13 ait sshd[224924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Feb  4 23:52:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-02-04 23:52:54 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:40850: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
description:
Feb  4 23:53:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.215.243.6
description:
2025-02-04 23:53:07 dovecot_plain authenticator failed for ([58.215.243.6]) [58.215.243.6]:52730: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.215.243.6
description:
Feb  4 23:53:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.215.243.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.133.214.161
description:
Feb  4 23:52:45 ait sshd[225010]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.133.214.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Feb  4 23:52:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
description:
2025-02-04 23:53:30 dovecot_plain authenticator failed for ([65.76.106.187]) [65.76.106.187]:57280: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
description:
2025-02-04 23:53:08 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:38751: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-02-04 23:52:43 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:48384: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.183.72.25
description:
Feb  4 23:52:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.183.72.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Feb  4 23:52:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-02-04 23:52:52 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:39454: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
description:
Feb  4 23:53:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Feb  4 23:52:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-02-04 23:52:36 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:45198: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
description:
Feb  4 23:52:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.133.214.161
description:
Feb  4 23:52:45 ait sshd[225010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.214.161  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-02-04 23:53:21 dovecot_plain authenticator failed for ([220.248.205.15]) [220.248.205.14]:1394: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
description:
2025-02-04 23:53:29 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:55031: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  4 23:52:54 ait sshd[225056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
description:
Feb  4 23:52:59 ait sshd[225189]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
description:
Feb  4 23:52:59 ait sshd[225189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Feb  4 23:53:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
description:
Feb  4 23:53:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
description:
2025-02-04 23:52:40 dovecot_plain authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:56095: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.183.72.25
description:
2025-02-04 23:52:50 dovecot_plain authenticator failed for ([59.183.72.25]) [59.183.72.25]:52142: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
description:
Feb  4 23:52:54 ait sshd[225056]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.95.217
description:
Feb  4 23:53:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.95.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
description:
2025-02-04 23:53:55 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:55611: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.85.163
description:
2025-02-04 23:54:30 dovecot_plain authenticator failed for ([87.201.85.163]) [87.201.85.163]:43346: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Feb  4 23:53:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.200.154.39
description:
Feb  4 23:53:33 ait sshd[225306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.200.154.39  user=lemsas


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  4 23:54:22 ait sshd[225681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.44.225
description:
Feb  4 23:53:38 ait sshd[225325]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.161.44.225 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.44.225
description:
Feb  4 23:53:38 ait sshd[225325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.44.225


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.191.42.22
description:
[2025-02-04 23:54:06 +0100] info [webmaild] 38.191.42.22 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  4 23:54:22 ait sshd[225681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.85.163
description:
Feb  4 23:54:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.201.85.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.200.154.39
description:
Feb  4 23:53:33 ait sshd[225306]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.200.154.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
description:
2025-02-04 23:53:42 dovecot_plain authenticator failed for ([38.148.95.217]) [38.148.95.217]:49478: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.144.28
description:
[2025-02-04 23:54:13 +0100] info [webmaild] 186.235.144.28 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
description:
Feb  4 23:53:39 ait sshd[225335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
description:
Feb  4 23:53:39 ait sshd[225335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
description:
Feb  4 23:53:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.7.167.138
description:
[2025-02-04 23:53:35 +0100] info [webmaild] 201.7.167.138 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-02-04 23:53:36 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:51458: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  4 23:54:42 ait sshd[225725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-02-04 23:54:42 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:51143: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.129.217
description:
[2025-02-04 23:54:49 +0100] info [webmaild] 181.116.129.217 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-04 23:55:15 dovecot_plain authenticator failed for (heineumers) [207.188.157.230]:6093: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Feb  4 23:54:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  4 23:54:42 ait sshd[225725]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  4 23:55:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.223.12.36
description:
[2025-02-04 23:56:21 +0100] info [webmaild] 179.223.12.36 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  4 23:55:59 ait sshd[226368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  4 23:55:59 ait sshd[226368]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  4 23:56:09 ait sshd[226537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  4 23:56:09 ait sshd[226537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Feb  4 23:56:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  4 23:55:51 ait sshd[226361]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  4 23:55:51 ait sshd[226361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.110.58.8
description:
[2025-02-04 23:56:50 +0100] info [webmaild] 190.110.58.8 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.212.2
description:
Feb  4 23:56:57 ait sshd[226663]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.68.212.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.68.212.2
description:
Feb  4 23:56:57 ait sshd[226663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.212.2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-02-04 23:56:32 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:37394: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
description:
Feb  4 23:56:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
description:
2025-02-04 23:56:46 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:49384: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.156.46.6
description:
[2025-02-04 23:56:56 +0100] info [webmaild] 102.156.46.6 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Feb  4 23:56:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-02-04 23:56:59 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:49406: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
description:
Feb  4 23:57:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-04 23:57:09 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:30342: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.219.128
description:
Feb  4 23:57:41 ait sshd[226906]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.130.219.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.130.219.128
description:
Feb  4 23:57:41 ait sshd[226906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.219.128


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 23:57:50 ait sshd[226917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 207.180.230.127
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:23-57.207.180.230.127


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  4 23:57:35 ait sshd[226897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 23:58:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
description:
Feb  4 23:58:01 ait sshd[226942]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
description:
Feb  4 23:58:01 ait sshd[226942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.127.224
description:
[2025-02-04 23:57:31 +0100] info [webmaild] 45.187.127.224 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  4 23:57:50 ait sshd[226917]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  4 23:57:35 ait sshd[226897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
description:
Feb  4 23:58:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
description:
Feb  4 23:58:57 ait sshd[227226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.27.5
description:
Feb  4 23:59:05 ait sshd[227386]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.27.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  4 23:58:33 ait sshd[227172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210  user=lemsas


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.199.165
description:
Feb  4 23:58:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  4 23:58:33 ait sshd[227172]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
description:
Feb  4 23:58:57 ait sshd[227226]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.134.188
description:
[2025-02-04 23:59:04 +0100] info [webmaild] 131.221.134.188 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
description:
2025-02-04 23:58:45 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:51270: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
description:
2025-02-04 23:58:58 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:36474: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.27.5
description:
Feb  4 23:59:05 ait sshd[227386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.27.5  user=bin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
description:
Feb  4 23:59:51 ait sshd[227660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
description:
Feb  4 23:59:51 ait sshd[227660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.38.130.171
description:
[2025-02-04 23:59:34 +0100] info [webmaild] 179.38.130.171 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
description:
Feb  4 23:59:36 ait sshd[227480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.44.21
description:
[2025-02-04 23:59:38 +0100] info [webmaild] 170.246.44.21 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  4 23:59:58 ait sshd[227705]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  4 23:59:58 ait sshd[227705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-00.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.234
description:
Feb  4 23:59:36 ait sshd[227480]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.71.27.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
description:
Feb  5 00:01:27 ait sshd[228489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.236.214
description:
Feb  5 00:01:37 ait sshd[228523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.236.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
description:
Feb  5 00:01:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  5 00:01:16 ait sshd[228474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102  user=bin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.203
description:
Feb  5 00:01:18 ait sshd[228476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  5 00:01:58 ait sshd[228572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 00:02:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.216.6.41
description:
[2025-02-05 00:00:14 +0100] info [webmaild] 186.216.6.41 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Feb  5 00:00:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Feb  5 00:01:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 85.215.236.96
description:
2025-02-05 00:02:24 dovecot_login authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:58796: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.114.194.46
description:
Feb  5 00:00:57 ait sshd[228280]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.114.194.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
description:
Feb  5 00:01:27 ait sshd[228489]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.203
description:
Feb  5 00:01:39 ait sshd[228476]: error: maximum authentication attempts exceeded for root from 218.92.0.203 port 36010 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-02-05 00:00:30 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:53095: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-02-05 00:00:40 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:26869: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  5 00:01:58 ait sshd[228572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 00:00:55 ait sshd[228275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Feb  5 00:01:11 ait sshd[228462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-02-05 00:01:13 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:45117: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Feb  5 00:01:11 ait sshd[228462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  5 00:01:16 ait sshd[228474]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.132.40
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:00-02.3.109.132.40


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
description:
Feb  5 00:00:50 ait sshd[228267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 00:00:55 ait sshd[228275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-02-05 00:02:18 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:58783: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.27.99
description:
[2025-02-05 00:02:23 +0100] info [webmaild] 170.245.27.99 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.203
description:
Feb  5 00:01:18 ait sshd[228476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
description:
2025-02-05 00:01:49 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:58023: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
description:
Feb  5 00:00:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.114.194.46
description:
Feb  5 00:00:57 ait sshd[228280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.114.194.46  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Feb  5 00:02:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
description:
Feb  5 00:00:50 ait sshd[228267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.236.214
description:
Feb  5 00:01:37 ait sshd[228523]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.236.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.203.91.89
description:
[2025-02-05 00:01:51 +0100] info [webmaild] 189.203.91.89 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.169.9
description:
[2025-02-05 00:02:28 +0100] info [webmaild] 191.243.169.9 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 00:02:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-05 00:02:59 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:53904: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.152.3.15
description:
[2025-02-05 00:03:02 +0100] info [webmaild] 200.152.3.15 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.88.29
description:
Feb  5 00:02:36 ait sshd[228857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.88.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  5 00:02:37 ait sshd[228871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  5 00:02:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Feb  5 00:03:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
description:
Feb  5 00:02:33 ait sshd[228853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  5 00:02:33 ait sshd[228853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.88.29
description:
Feb  5 00:02:36 ait sshd[228857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.88.29  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  5 00:02:37 ait sshd[228871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
description:
Feb  5 00:02:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-02-05 00:02:49 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:32983: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  5 00:03:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Feb  5 00:03:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.48.171.141
description:
Feb  5 00:04:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.48.171.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
description:
Feb  5 00:03:32 ait sshd[229095]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.247.174
description:
Feb  5 00:04:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.247.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Feb  5 00:03:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
description:
Feb  5 00:03:32 ait sshd[229095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.173.174
description:
Feb  5 00:04:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.173.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 00:04:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Feb  5 00:04:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.26.96
description:
Feb  5 00:04:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.26.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.64.213
description:
[2025-02-05 00:05:08 +0100] info [webmaild] 157.100.64.213 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.198.146.65
description:
Feb  5 00:05:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.198.146.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.198.146.65
description:
2025-02-05 00:05:30 dovecot_plain authenticator failed for 6dc69241.rev.dansknet.dk [109.198.146.65]:60126: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.10.101.227
description:
[2025-02-05 00:04:32 +0100] info [webmaild] 38.10.101.227 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.83.143
description:
[2025-02-05 00:05:03 +0100] info [webmaild] 182.48.83.143 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-02-05 00:05:46 dovecot_login authenticator failed for (www.nettlinx.com) [202.53.94.242]:35702: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
description:
2025-02-05 00:05:56 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:54104: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.91.114.98
description:
Feb  5 00:05:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.91.114.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
description:
2025-02-05 00:06:15 dovecot_plain authenticator failed for ([58.18.64.54]) [58.18.64.54]:42755: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
description:
2025-02-05 00:06:06 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:55509: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Feb  5 00:06:21 ait sshd[230499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-05 00:05:40 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:32909: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Feb  5 00:05:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-02-05 00:05:54 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:43010: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.91.114.98
description:
2025-02-05 00:06:01 dovecot_login authenticator failed for ec2-3-91-114-98.compute-1.amazonaws.com (ait.edu.gh) [3.91.114.98]:56425: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
description:
Feb  5 00:06:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
description:
Feb  5 00:06:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
description:
2025-02-05 00:06:25 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:15369: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.25.73
description:
Feb  5 00:06:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.25.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
description:
Feb  5 00:05:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-02-05 00:05:38 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:34024: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.149.190
description:
[2025-02-05 00:05:42 +0100] info [webmaild] 186.219.149.190 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
description:
Feb  5 00:05:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  5 00:05:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Feb  5 00:05:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
description:
Feb  5 00:06:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
description:
Feb  5 00:06:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
description:
Feb  5 00:06:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Feb  5 00:06:21 ait sshd[230499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
description:
2025-02-05 00:05:34 dovecot_login authenticator failed for ([211.243.43.30]) [211.243.43.30]:49386: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.188.226
description:
Feb  5 00:05:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.188.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Feb  5 00:05:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.188.226
description:
2025-02-05 00:05:38 dovecot_plain authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:42994: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.118.211
description:
Feb  5 00:06:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.118.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-02-05 00:06:50 dovecot_plain authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:64563: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
description:
2025-02-05 00:07:06 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:60964: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
description:
2025-02-05 00:06:32 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:20627: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Feb  5 00:06:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-05 00:06:35 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:38968: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  5 00:06:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
description:
2025-02-05 00:06:32 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:59009: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-02-05 00:06:44 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:33758: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-02-05 00:06:47 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:33178: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  5 00:06:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-05 00:06:58 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:47914: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Feb  5 00:06:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  5 00:06:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-02-05 00:06:40 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:39100: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-05 00:06:44 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:49160: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Feb  5 00:06:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.10.255
description:
Feb  5 00:07:06 ait sshd[230619]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.10.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
description:
Feb  5 00:07:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.118.211
description:
2025-02-05 00:06:41 dovecot_plain authenticator failed for ([46.35.118.211]) [46.35.118.211]:53841: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Feb  5 00:06:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  5 00:06:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-02-05 00:06:55 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:36186: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.222.68
description:
[2025-02-05 00:07:06 +0100] info [webmaild] 177.8.222.68 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.10.255
description:
Feb  5 00:07:06 ait sshd[230619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.10.255


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.25.73
description:
2025-02-05 00:06:32 dovecot_plain authenticator failed for ([31.173.25.73]) [31.173.25.73]:56438: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.181.192.89
description:
[2025-02-05 00:07:36 +0100] info [webmaild] 187.181.192.89 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.97.30.169
description:
[2025-02-05 00:07:45 +0100] info [webmaild] 179.97.30.169 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  5 00:07:56 ait sshd[230820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Feb  5 00:08:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-02-05 00:08:26 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:40006: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Feb  5 00:07:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-05 00:07:40 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:37033: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Feb  5 00:08:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-02-05 00:08:31 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:55692: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Feb  5 00:07:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-02-05 00:07:55 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:40553: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  5 00:07:56 ait sshd[230820]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.66.3
description:
[2025-02-05 00:08:18 +0100] info [webmaild] 45.234.66.3 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 00:09:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Feb  5 00:08:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Feb  5 00:09:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.121.9
description:
Feb  5 00:08:53 ait sshd[231104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.121.9


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-02-05 00:09:02 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:46206: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.218.158.114
description:
Feb  5 00:09:11 ait sshd[231166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.218.158.114


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
description:
Feb  5 00:09:15 ait sshd[231298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Feb  5 00:08:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-02-05 00:08:42 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:46095: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Feb  5 00:09:10 ait sshd[231163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  5 00:09:28 ait sshd[231316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-02-05 00:08:36 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:36277: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Feb  5 00:08:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.218.158.114
description:
Feb  5 00:09:11 ait sshd[231166]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.218.158.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
description:
Feb  5 00:09:15 ait sshd[231298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  5 00:09:28 ait sshd[231316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-02-05 00:08:45 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:35169: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.121.9
description:
Feb  5 00:08:53 ait sshd[231104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.121.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.153.85.132
description:
Feb  5 00:10:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.153.85.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
description:
2025-02-05 00:10:19 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:51950: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.47.166
description:
Feb  5 00:10:29 ait sshd[231864]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.47.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  5 00:09:45 ait sshd[231357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-02-05 00:09:47 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:41623: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.14.124.160
description:
[2025-02-05 00:09:33 +0100] info [webmaild] 200.14.124.160 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.47.166
description:
Feb  5 00:10:29 ait sshd[231864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.47.166


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.121.9
description:
Feb  5 00:09:36 ait sshd[231342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.121.9


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 00:10:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-05 00:10:09 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:53330: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
description:
Feb  5 00:10:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.103.231
description:
Feb  5 00:10:30 ait sshd[231872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.103.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Feb  5 00:09:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
description:
Feb  5 00:10:06 ait sshd[231551]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
description:
Feb  5 00:10:06 ait sshd[231551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.103.231
description:
Feb  5 00:10:30 ait sshd[231872]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.103.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.121.9
description:
Feb  5 00:09:36 ait sshd[231342]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.121.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  5 00:09:45 ait sshd[231357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.88.50.154
description:
[2025-02-05 00:10:03 +0100] info [webmaild] 201.88.50.154 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
description:
2025-02-05 00:10:02 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:41162: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.33.146
description:
[2025-02-05 00:10:25 +0100] info [webmaild] 45.4.33.146 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.253
description:
[2025-02-05 00:10:26 +0100] info [cpaneld] 104.207.56.253 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.103.231
description:
Feb  5 00:10:33 ait sshd[231872]: Failed password for invalid user ciro from 64.227.103.231 port 58932 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Feb  5 00:10:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-02-05 00:10:43 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:63504: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.36.199
description:
[2025-02-05 00:10:44 +0100] info [whostmgrd] 104.207.36.199 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.179.58
description:
Feb  5 00:10:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.179.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-02-05 00:11:22 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:43258: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  5 00:11:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-05 00:11:31 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:45799: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
description:
Feb  5 00:10:42 ait sshd[231923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.141
description:
[2025-02-05 00:10:47 +0100] info [whostmgrd] 156.228.106.141 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
description:
Feb  5 00:10:53 ait sshd[232013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.92.39
description:
[2025-02-05 00:10:56 +0100] info [whostmgrd] 156.228.92.39 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  5 00:11:06 ait sshd[232062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.100.34
description:
[2025-02-05 00:10:53 +0100] info [whostmgrd] 156.228.100.34 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.169.193.112
domain: aitstaff.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:00-11.52.169.193.112||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-02-05 00:11:16 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:40541: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
description:
Feb  5 00:10:42 ait sshd[231923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Feb  5 00:10:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.84
description:
[2025-02-05 00:10:54 +0100] info [whostmgrd] 156.228.111.84 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.179.58
description:
2025-02-05 00:10:55 dovecot_login authenticator failed for ([122.224.179.58]) [122.224.179.58]:60398: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Feb  5 00:11:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.199
description:
[2025-02-05 00:10:38 +0100] info [cpaneld] 156.228.101.199 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Feb  5 00:11:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.92.77
description:
[2025-02-05 00:10:40 +0100] info [cpaneld] 156.228.92.77 - ads23b00195y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads23b00195y (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
description:
Feb  5 00:10:53 ait sshd[232013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.6.49.177
description:
[2025-02-05 00:10:54 +0100] info [webmaild] 190.6.49.177 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-02-05 00:10:57 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:49561: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.193.112
domain: aitstaff.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/414.php||SC:/home/titlemas/public_html/AITSTAFF.NET/wp-content


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  5 00:11:06 ait sshd[232062]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-02-05 00:11:41 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:51670: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-02-05 00:11:42 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:38030: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 00:12:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
description:
Feb  5 00:12:27 ait sshd[232562]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Feb  5 00:11:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Feb  5 00:11:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
description:
Feb  5 00:12:27 ait sshd[232562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.231.69
description:
[2025-02-05 00:12:12 +0100] info [webmaild] 37.236.231.69 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 00:12:53 ait sshd[232640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.15.163.18
description:
Feb  5 00:13:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.15.163.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.86.58.117
description:
2025-02-05 00:13:27 dovecot_plain authenticator failed for ([222.86.58.117]) [222.86.58.117]:57775: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.53.0.107
description:
[2025-02-05 00:13:29 +0100] info [webmaild] 181.53.0.107 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.16.85.102
description:
Feb  5 00:13:11 ait sshd[232709]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.16.85.102 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.58.251
description:
47.128.58.251 - - [05/Feb/2025:00:13:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11141296 HTTP/2.0" 302 0 worldwide-university.com "https://worldwide-university.com/2022/08/16/wp-global-styles-oceanwp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.58.251


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.5.53
description:
[2025-02-05 00:12:43 +0100] info [webmaild] 179.6.5.53 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
description:
2025-02-05 00:13:07 dovecot_plain authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:25125: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 00:12:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.86.58.117
description:
Feb  5 00:13:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.86.58.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 00:12:53 ait sshd[232640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.236.162.170
description:
[2025-02-05 00:12:54 +0100] info [webmaild] 88.236.162.170 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.16.85.102
description:
Feb  5 00:13:11 ait sshd[232709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.16.85.102


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
description:
Feb  5 00:14:19 ait sshd[233273]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
description:
Feb  5 00:14:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-02-05 00:14:25 dovecot_plain authenticator failed for ([1.183.1.82]) [1.183.1.82]:40657: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-05 00:14:28 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:39428: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-02-05 00:14:25 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:57317: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
description:
Feb  5 00:14:19 ait sshd[233273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  5 00:14:21 ait sshd[233278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  5 00:14:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  5 00:14:09 ait sshd[233134]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Feb  5 00:14:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  5 00:14:21 ait sshd[233278]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Feb  5 00:14:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  5 00:14:09 ait sshd[233134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-02-05 00:14:11 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:42253: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  5 00:14:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  5 00:14:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
description:
2025-02-05 00:15:10 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:48548: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
description:
Feb  5 00:15:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.80.209
description:
Feb  5 00:14:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.80.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
description:
Feb  5 00:14:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.195.225.182
description:
Feb  5 00:14:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.195.225.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
description:
Feb  5 00:15:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Feb  5 00:15:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
description:
Feb  5 00:14:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.224
description:
2025-02-05 00:15:04 dovecot_plain authenticator failed for 110-25-105-224.adsl.fetnet.net [110.25.105.224]:38776: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-02-05 00:15:05 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:56193: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
description:
2025-02-05 00:15:16 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:50655: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  5 00:14:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.81.117.20
description:
Feb  5 00:15:01 ait sshd[233390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.81.117.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
description:
2025-02-05 00:15:08 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:45027: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 00:14:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-02-05 00:15:04 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:58207: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
description:
Feb  5 00:15:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Feb  5 00:15:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Feb  5 00:15:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  5 00:14:44 ait sshd[233337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
description:
Feb  5 00:14:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
description:
2025-02-05 00:14:50 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:50080: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  5 00:15:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.174.147
description:
Feb  5 00:15:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.174.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.201.78.193
description:
2025-02-05 00:15:19 dovecot_plain authenticator failed for ([175.201.78.193]) [175.201.78.193]:38776: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Feb  5 00:14:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.145.34
description:
[2025-02-05 00:14:55 +0100] info [webmaild] 187.62.145.34 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.11.249
description:
Feb  5 00:15:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.11.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Feb  5 00:15:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.84.220
description:
2025-02-05 00:14:57 dovecot_plain authenticator failed for ([175.210.84.220]) [175.210.84.220]:56704: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 00:15:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
description:
2025-02-05 00:15:20 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:55706: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
description:
2025-02-05 00:15:01 dovecot_plain authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:60712: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-05 00:14:53 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:40734: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Feb  5 00:14:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-05 00:14:56 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:37687: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
description:
2025-02-05 00:14:50 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:60661: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Feb  5 00:14:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-05 00:15:03 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:52873: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
description:
Feb  5 00:15:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-05 00:15:15 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:51486: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 00:15:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-02-05 00:14:50 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:4179: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-02-05 00:14:57 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:31720: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.174.147
description:
2025-02-05 00:15:04 dovecot_plain authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:52924: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
description:
2025-02-05 00:14:37 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:62892: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-02-05 00:15:05 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:44227: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.34.17.130
description:
Feb  5 00:15:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.34.17.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-02-05 00:15:16 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:40376: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-02-05 00:15:10 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:37726: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 00:15:18 dovecot_plain authenticator failed for ([27.223.100.91]) [27.223.100.90]:39740: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
description:
2025-02-05 00:14:52 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:58602: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 00:14:54 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-194.tpgi.com.au) [110.175.220.250]:39676: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.42.62
description:
Feb  5 00:15:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.42.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-02-05 00:15:14 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:35328: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.68
description:
2025-02-05 00:14:52 dovecot_plain authenticator failed for ([65.20.161.68]) [65.20.161.68]:43546: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.80.209
description:
2025-02-05 00:14:50 dovecot_plain authenticator failed for ([2.55.80.209]) [2.55.80.209]:34135: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  5 00:14:58 ait sshd[233377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
description:
Feb  5 00:15:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-02-05 00:15:12 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:24142: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.11.249
description:
2025-02-05 00:15:16 dovecot_plain authenticator failed for ([202.179.85.98]) [103.207.11.249]:27266: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  5 00:14:44 ait sshd[233337]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
description:
2025-02-05 00:14:58 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:54449: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 65.21.58.141
description:
Feb  5 00:15:03 ait sshd[233595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.21.58.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Feb  5 00:15:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Feb  5 00:15:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-02-05 00:14:43 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:32927: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
description:
2025-02-05 00:14:51 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:35747: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
description:
2025-02-05 00:14:52 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:56474: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Feb  5 00:15:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-02-05 00:15:09 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:60844: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Feb  5 00:14:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.161.68
description:
Feb  5 00:14:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.161.68 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-14.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  5 00:14:58 ait sshd[233377]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
description:
Feb  5 00:14:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-02-05 00:15:21 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:43995: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-05 00:14:52 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:29274: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Feb  5 00:14:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.84.220
description:
Feb  5 00:14:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.84.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-02-05 00:15:03 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:54819: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
description:
2025-02-05 00:15:10 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:47249: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.76.106.226
description:
Feb  5 00:15:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.76.106.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.23
description:
Feb  5 00:14:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Feb  5 00:15:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.195.225.182
description:
2025-02-05 00:15:01 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:39134: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.42.62
description:
2025-02-05 00:15:16 dovecot_plain authenticator failed for ([27.115.42.62]) [27.115.42.62]:49242: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Feb  5 00:14:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  5 00:14:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  5 00:15:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.143.228.83
description:
[2025-02-05 00:15:24 +0100] info [webmaild] 41.143.228.83 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
description:
Feb  5 00:14:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  5 00:14:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-05 00:14:54 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:42961: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-02-05 00:15:05 dovecot_plain authenticator failed for ([221.195.208.171]) [221.195.208.171]:52526: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-02-05 00:15:18 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:57606: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-02-05 00:14:57 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:41487: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.224
description:
Feb  5 00:15:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Feb  5 00:15:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Feb  5 00:15:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
description:
Feb  5 00:14:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
description:
2025-02-05 00:14:51 dovecot_plain authenticator failed for ([178.178.194.203]) [178.178.194.203]:56090: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-02-05 00:14:56 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:45490: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.81.117.20
description:
Feb  5 00:15:01 ait sshd[233390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.81.117.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Feb  5 00:15:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.201.78.193
description:
Feb  5 00:15:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.201.78.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-02-05 00:15:10 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:23407: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-05 00:14:54 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:53607: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-02-05 00:14:54 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:48926: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
description:
Feb  5 00:14:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
description:
Feb  5 00:14:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.21.58.141
description:
Feb  5 00:15:03 ait sshd[233595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 65.21.58.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
description:
Feb  5 00:16:01 ait sshd[234058]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
description:
2025-02-05 00:16:12 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:57714: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Feb  5 00:16:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Feb  5 00:16:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.2.190.33
description:
[2025-02-05 00:16:29 +0100] info [webmaild] 181.2.190.33 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Feb  5 00:16:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Feb  5 00:15:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-02-05 00:15:38 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:46234: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-02-05 00:15:43 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:37399: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.52.89.161
description:
[2025-02-05 00:15:54 +0100] info [webmaild] 102.52.89.161 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
description:
Feb  5 00:16:01 ait sshd[234058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Feb  5 00:16:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-02-05 00:16:04 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:37782: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-02-05 00:15:33 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:38500: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-02-05 00:16:19 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:48930: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-02-05 00:16:14 dovecot_plain authenticator failed for (noman) [77.239.255.163]:44142: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Feb  5 00:15:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
description:
Feb  5 00:16:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
description:
2025-02-05 00:16:20 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:60276: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Feb  5 00:16:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Feb  5 00:15:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
description:
Feb  5 00:16:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  5 00:16:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Feb  5 00:17:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  5 00:17:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Feb  5 00:17:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.2.172
description:
Feb  5 00:17:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.2.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Feb  5 00:17:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
description:
Feb  5 00:17:19 ait sshd[234493]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  5 00:16:30 ait sshd[234260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  5 00:16:30 ait sshd[234260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.134
description:
Feb  5 00:16:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.118.145.212
description:
Feb  5 00:16:46 ait sshd[234344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.118.145.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.207
description:
2025-02-05 00:16:53 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:58271: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-05 00:17:06 dovecot_plain authenticator failed for (korks) [81.211.77.58]:24768: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-02-05 00:17:08 dovecot_login authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:42792: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Feb  5 00:17:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.221.48
description:
Feb  5 00:17:22 ait sshd[234628]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.221.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
description:
Feb  5 00:17:25 ait sshd[234638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-02-05 00:17:05 dovecot_login authenticator failed for ([36.135.125.196]) [36.135.125.196]:39630: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
description:
2025-02-05 00:17:14 dovecot_plain authenticator failed for ([27.40.100.131]) [27.40.100.131]:36070: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.229
description:
2025-02-05 00:17:15 dovecot_login authenticator failed for ([112.31.93.229]) [112.31.93.229]:39274: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-05 00:17:19 dovecot_login authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:51380: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.221.48
description:
Feb  5 00:17:22 ait sshd[234628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.221.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-02-05 00:16:31 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:49042: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.207
description:
Feb  5 00:16:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Feb  5 00:17:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-05 00:17:04 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:56114: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
description:
Feb  5 00:17:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
description:
Feb  5 00:17:15 ait sshd[234478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-02-05 00:17:17 dovecot_login authenticator failed for ([183.247.194.8]) [183.247.194.8]:36642: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-02-05 00:17:16 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:53650: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Feb  5 00:17:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
description:
2025-02-05 00:16:34 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:43830: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.42.163.252
description:
Feb  5 00:16:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.42.163.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
description:
2025-02-05 00:17:00 dovecot_plain authenticator failed for ([185.42.163.252]) [185.42.163.252]:45982: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.60.92
description:
47.128.60.92 - - [05/Feb/2025:00:17:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14670066 HTTP/2.0" 302 0 tutor.aitedu.us "https://tutor.aitedu.us/courses/new-course-44/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.60.92


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
description:
Feb  5 00:17:15 ait sshd[234478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.213.54.196
description:
[2025-02-05 00:17:24 +0100] info [webmaild] 188.213.54.196 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.134
description:
2025-02-05 00:16:34 dovecot_plain authenticator failed for ([27.45.233.134]) [27.45.233.134]:47658: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-05 00:16:43 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:36058: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.118.145.212
description:
Feb  5 00:16:46 ait sshd[234344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.118.145.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.229
description:
Feb  5 00:17:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.172
description:
2025-02-05 00:17:16 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:49708: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  5 00:17:19 ait sshd[234493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  5 00:17:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-02-05 00:17:03 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:53688: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Feb  5 00:18:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Feb  5 00:18:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
description:
2025-02-05 00:18:21 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:55020: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.7.58
description:
[2025-02-05 00:18:24 +0100] info [webmaild] 177.12.7.58 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
description:
Feb  5 00:17:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
description:
2025-02-05 00:17:49 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:51236: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-02-05 00:18:03 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (sampop) [2.36.64.247]:58867: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 00:18:13 ait sshd[234766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-02-05 00:18:15 dovecot_plain authenticator failed for ([27.188.73.223]) [27.188.73.223]:39712: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.222.7
description:
[2025-02-05 00:17:56 +0100] info [webmaild] 45.164.222.7 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.170.81
description:
Feb  5 00:17:48 ait sshd[234701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.170.81


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  5 00:18:02 ait sshd[234720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  5 00:18:13 ait sshd[234766]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.170.81
description:
Feb  5 00:17:48 ait sshd[234701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.170.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Feb  5 00:18:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  5 00:18:02 ait sshd[234720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 00:18:34 dovecot_login authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:59330: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
description:
Feb  5 00:18:43 ait sshd[234953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-02-05 00:19:11 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:38054: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-02-05 00:18:45 dovecot_login authenticator failed for ([142.79.232.38]) [142.79.232.38]:64750: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Feb  5 00:18:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-02-05 00:19:00 dovecot_plain authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:41475: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
description:
Feb  5 00:18:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  5 00:18:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
description:
2025-02-05 00:18:54 dovecot_login authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be [81.243.106.218]:58498: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.127.92
description:
[2025-02-05 00:18:59 +0100] info [webmaild] 177.37.127.92 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 00:19:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
description:
2025-02-05 00:18:45 dovecot_login authenticator failed for ([151.69.157.215]) [151.69.157.215]:53969: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.210.10
description:
Feb  5 00:18:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.210.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  5 00:18:36 ait sshd[234931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.243.106.218
description:
Feb  5 00:18:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.243.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
description:
2025-02-05 00:18:32 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:34252: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.229.118.208
description:
Feb  5 00:18:36 ait sshd[234931]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.229.118.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Feb  5 00:19:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Feb  5 00:19:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Feb  5 00:19:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.125.146.242
description:
2025-02-05 00:20:04 dovecot_login authenticator failed for ([206.125.146.242]) [206.125.146.242]:40454: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  5 00:20:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Feb  5 00:20:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.119.126.81
description:
Feb  5 00:20:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.119.126.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
description:
2025-02-05 00:20:06 dovecot_login authenticator failed for ([220.119.126.81]) [220.119.126.81]:47455: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Feb  5 00:19:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-02-05 00:19:48 dovecot_login authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:54492: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Feb  5 00:19:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
description:
2025-02-05 00:19:52 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:46286: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.125.146.242
description:
Feb  5 00:20:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.125.146.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.215.27.224
description:
Feb  5 00:20:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.215.27.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-02-05 00:20:07 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:53740: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
description:
2025-02-05 00:20:14 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:39613: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
description:
Feb  5 00:19:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-05 00:19:55 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:63193: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Feb  5 00:19:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Feb  5 00:20:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-02-05 00:20:18 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:62033: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
description:
2025-02-05 00:20:21 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:47222: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-02-05 00:19:53 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:59042: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.50
description:
Feb  5 00:19:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
description:
Feb  5 00:20:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.59.246.56
description:
[2025-02-05 00:20:22 +0100] info [webmaild] 185.59.246.56 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
description:
Feb  5 00:19:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
description:
Feb  5 00:19:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-02-05 00:19:53 dovecot_login authenticator failed for ([103.196.30.122]) [103.196.30.122]:47667: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-02-05 00:20:07 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:54297: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
description:
2025-02-05 00:20:08 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:35296: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-02-05 00:20:25 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:33982: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Feb  5 00:20:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.136.108.201
description:
Feb  5 00:20:16 ait sshd[235565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.108.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Feb  5 00:19:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.27.224
description:
2025-02-05 00:20:06 dovecot_plain authenticator failed for ([88.215.27.224]) [88.215.27.224]:53658: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
description:
Feb  5 00:20:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Feb  5 00:20:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.202.159.233
description:
Feb  5 00:20:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.202.159.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Feb  5 00:20:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Feb  5 00:20:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-02-05 00:20:15 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:44068: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-02-05 00:19:50 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:59214: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.70.67.28
description:
[2025-02-05 00:19:52 +0100] info [webmaild] 196.70.67.28 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
description:
Feb  5 00:19:54 ait sshd[235279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Feb  5 00:20:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.203.158
description:
Feb  5 00:20:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.203.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-05 00:20:21 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:58270: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.203.158
description:
2025-02-05 00:20:19 dovecot_login authenticator failed for ([211.46.203.158]) [211.46.203.158]:50421: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
description:
Feb  5 00:19:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 00:19:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Feb  5 00:19:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-02-05 00:20:00 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:40150: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-02-05 00:20:11 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:58838: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Feb  5 00:19:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Feb  5 00:19:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-02-05 00:19:58 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:51771: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
description:
Feb  5 00:20:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
description:
2025-02-05 00:19:53 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:34125: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-02-05 00:19:57 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:62109: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-02-05 00:20:10 dovecot_login authenticator failed for ([114.242.61.19]) [114.242.61.35]:46912: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-02-05 00:20:11 dovecot_plain authenticator failed for ([58.218.163.130]) [58.218.163.130]:44874: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
description:
Feb  5 00:20:17 ait sshd[235593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.136.108.201
description:
Feb  5 00:20:16 ait sshd[235565]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.136.108.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  5 00:20:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
description:
Feb  5 00:19:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
description:
2025-02-05 00:19:53 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:54366: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.50
description:
2025-02-05 00:19:56 dovecot_plain authenticator failed for ([61.185.68.50]) [61.185.68.50]:33633: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Feb  5 00:20:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.202.159.233
description:
2025-02-05 00:20:06 dovecot_plain authenticator failed for ec2-52-202-159-233.compute-1.amazonaws.com [52.202.159.233]:52764: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-02-05 00:20:09 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:42321: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-02-05 00:19:54 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:36840: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-02-05 00:19:55 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:34658: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
description:
2025-02-05 00:19:55 dovecot_plain authenticator failed for ([111.53.52.116]) [111.53.52.116]:51984: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
description:
Feb  5 00:20:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-02-05 00:20:11 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:55707: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
description:
Feb  5 00:20:17 ait sshd[235593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
description:
Feb  5 00:21:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
description:
2025-02-05 00:21:22 dovecot_plain authenticator failed for ([60.172.41.103]) [60.172.41.103]:48279: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.92.220
description:
Feb  5 00:21:30 ait sshd[239512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.92.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.92.220
description:
Feb  5 00:21:30 ait sshd[239512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.92.220


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.102.159
description:
[2025-02-05 00:21:04 +0100] info [webmaild] 45.228.102.159 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.115.43
description:
47.128.115.43 - - [05/Feb/2025:00:21:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17712675 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=57&__im-eTapwjdo=3010872594242566584&id=49&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.115.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-02-05 00:21:55 dovecot_login authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:34265: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
description:
2025-02-05 00:22:01 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:58824: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  5 00:22:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.79.235.190
domain: jabmar.org
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/admin/upload/css.php||SC:/home/titlemas/public_html/JABMAR.org/admin


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.220
description:
Feb  5 00:21:32 ait sshd[239512]: Failed password for invalid user koko from 103.82.92.220 port 44224 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Feb  5 00:21:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.161
description:
Feb  5 00:22:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-05 00:22:02 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:19279: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Feb  5 00:22:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Feb  5 00:22:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.134
description:
2025-02-05 00:21:57 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:53842: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 00:22:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
description:
Feb  5 00:22:00 ait sshd[239935]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-05 00:22:03 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:49404: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  5 00:22:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-02-05 00:22:16 dovecot_login authenticator failed for ([211.238.237.254]) [211.238.237.254]:55071: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
description:
2025-02-05 00:21:59 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:55864: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
description:
2025-02-05 00:22:04 dovecot_login authenticator failed for ([65.20.169.151]) [65.20.169.151]:37185: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-05 00:22:11 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:52990: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.34.28
description:
2025-02-05 00:22:13 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:37277: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.94.206.187
description:
Feb  5 00:21:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.94.206.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
description:
Feb  5 00:21:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
description:
2025-02-05 00:21:50 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:37194: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
description:
2025-02-05 00:22:03 dovecot_login authenticator failed for (m121-202-154-161.smartone.com) [121.202.154.161]:2822: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.188.78.231
description:
[2025-02-05 00:22:21 +0100] info [webmaild] 90.188.78.231 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.138.250.72
description:
[2025-02-05 00:21:39 +0100] info [webmaild] 103.138.250.72 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Feb  5 00:21:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
description:
Feb  5 00:22:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Feb  5 00:22:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-02-05 00:22:13 dovecot_login authenticator failed for ([219.248.65.30]) [219.248.65.30]:55550: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  5 00:22:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
description:
Feb  5 00:22:00 ait sshd[239935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.183
description:
Feb  5 00:21:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
description:
Feb  5 00:22:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.34.28
description:
Feb  5 00:22:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
description:
2025-02-05 00:22:26 dovecot_login authenticator failed for ([124.112.45.222]) [124.112.45.222]:57900: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-02-05 00:21:43 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:46710: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.134
description:
Feb  5 00:21:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-05 00:24:26 dovecot_login authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:55721: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-02-05 00:23:38 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:46327: 535 Incorrect authentication data (set_id=eng20a00070y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.231.137.153
description:
Feb  5 00:23:50 ait sshd[241028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.231.137.153 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.231.137.153
description:
Feb  5 00:23:50 ait sshd[241028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.231.137.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  5 00:24:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Feb  5 00:23:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Feb  5 00:24:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-02-05 00:23:56 dovecot_login authenticator failed for ([121.202.155.250]) [121.202.155.250]:16313: 535 Incorrect authentication data (set_id=eng20a00113y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
description:
2025-02-05 00:24:24 dovecot_login authenticator failed for ([45.65.68.104]) [45.65.68.104]:56446: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.248.3.92
description:
Feb  5 00:23:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.248.3.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.248.3.92
description:
2025-02-05 00:23:46 dovecot_login authenticator failed for ([162.248.3.92]) [162.248.3.92]:35771: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.253.194.27
description:
2025-02-05 00:23:55 dovecot_login authenticator failed for ([58.253.194.27]) [58.253.194.27]:51880: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.253.194.27
description:
Feb  5 00:23:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.253.194.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Feb  5 00:23:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.249.169.112
description:
[2025-02-05 00:24:07 +0100] info [webmaild] 85.249.169.112 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-02-05 00:24:12 dovecot_login authenticator failed for ([175.156.154.149]) [175.156.154.149]:33551: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
description:
Feb  5 00:24:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.4.108.47
description:
[2025-02-05 00:23:32 +0100] info [webmaild] 189.4.108.47 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.234.208
description:
Feb  5 00:23:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.234.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
description:
Feb  5 00:24:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
description:
2025-02-05 00:24:25 dovecot_login authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:55615: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
description:
Feb  5 00:25:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Feb  5 00:25:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.71.37.202
description:
2025-02-05 00:25:24 dovecot_login authenticator failed for ([47.98.191.121]) [101.71.37.202]:42631: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-02-05 00:25:31 dovecot_login authenticator failed for ([218.75.30.6]) [218.75.30.6]:39737: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Feb  5 00:24:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Feb  5 00:24:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-02-05 00:24:51 dovecot_login authenticator failed for ([39.174.252.131]) [39.174.252.131]:57874: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.248.192.204
description:
Feb  5 00:24:58 ait sshd[241305]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.248.192.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Feb  5 00:24:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
description:
2025-02-05 00:25:19 dovecot_login authenticator failed for ([222.114.84.175]) [222.114.84.175]:59368: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.67.185.48
description:
Feb  5 00:24:38 ait sshd[241263]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.67.185.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-02-05 00:24:38 dovecot_login authenticator failed for ([175.208.186.206]) [175.208.186.206]:35834: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.248.192.204
description:
Feb  5 00:24:58 ait sshd[241305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.248.192.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-02-05 00:25:19 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:56036: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-05 00:25:25 dovecot_login authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:57903: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Feb  5 00:25:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.253.194.27
description:
Feb  5 00:24:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.253.194.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.253.194.27
description:
2025-02-05 00:24:37 dovecot_login authenticator failed for ([58.253.194.27]) [58.253.194.27]:52106: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-02-05 00:24:43 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:30531: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.71.37.202
description:
Feb  5 00:25:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.71.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  5 00:25:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-02-05 00:25:29 dovecot_login authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:54360: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  5 00:24:38 ait sshd[241263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Feb  5 00:25:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-02-05 00:25:14 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:56879: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.0.10.6
description:
[2025-02-05 00:25:01 +0100] info [webmaild] 131.0.10.6 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.38
description:
[2025-02-05 00:25:08 +0100] info [webmaild] 104.207.57.38 - ads19a00020y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user ads19a00020y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Feb  5 00:25:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.80.25.69
description:
[2025-02-05 00:25:32 +0100] info [webmaild] 181.80.25.69 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-05 00:25:38 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:49354: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  5 00:25:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.113.230.9
description:
Feb  5 00:26:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.113.230.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.113.230.9
description:
2025-02-05 00:26:15 dovecot_login authenticator failed for p167010-obmd01.osaka.ocn.ne.jp [61.113.230.9]:50638: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  5 00:25:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-05 00:25:41 dovecot_login authenticator failed for ([121.202.154.173]) [121.202.154.173]:51722: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 92.53.96.165
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:00-25.92.53.96.165


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  5 00:26:08 ait sshd[242047]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  5 00:26:08 ait sshd[242047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Feb  5 00:26:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  5 00:26:32 ait sshd[242265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.221.49.33
description:
[2025-02-05 00:26:38 +0100] info [webmaild] 179.221.49.33 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
description:
Feb  5 00:26:50 ait sshd[242286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Feb  5 00:27:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-02-05 00:27:11 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:49342: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  5 00:27:14 ait sshd[242350]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.73.242
description:
Feb  5 00:27:27 ait sshd[242369]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.37.73.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.37.73.242
description:
Feb  5 00:27:27 ait sshd[242369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.37.73.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  5 00:26:32 ait sshd[242265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
description:
Feb  5 00:26:33 ait sshd[242263]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Feb  5 00:27:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  5 00:27:14 ait sshd[242350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-05 00:26:31 dovecot_login authenticator failed for (usr.1net.by.225.172.178.in-addr.arpa) [178.172.225.52]:51296: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  5 00:26:33 ait sshd[242263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.202.186.103
description:
[2025-02-05 00:26:56 +0100] info [webmaild] 176.202.186.103 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-02-05 00:27:03 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:33001: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-02-05 00:28:27 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:51794: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-02-05 00:27:50 dovecot_plain authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:53492: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  5 00:28:07 ait sshd[243044]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.154.40.209
description:
[2025-02-05 00:28:11 +0100] info [webmaild] 179.154.40.209 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-02-05 00:28:03 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:60878: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Feb  5 00:28:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.59
description:
47.128.59.59 - - [05/Feb/2025:00:28:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16736377 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/a0f9f8?panel=router" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Feb  5 00:27:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  5 00:28:08 ait sshd[243044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  5 00:28:13 ait sshd[243058]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 00:28:25 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:44734: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.172.19
description:
[2025-02-05 00:27:34 +0100] info [webmaild] 181.115.172.19 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Feb  5 00:28:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  5 00:28:13 ait sshd[243058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  5 00:28:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Feb  5 00:28:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-02-05 00:28:42 dovecot_plain authenticator failed for ([58.18.81.242]) [58.18.81.242]:60989: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.149.118.81
description:
[2025-02-05 00:28:59 +0100] info [webmaild] 201.149.118.81 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
description:
2025-02-05 00:28:40 dovecot_plain authenticator failed for ([221.2.207.134]) [221.2.207.134]:57259: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  5 00:29:03 ait sshd[243313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
description:
Feb  5 00:29:16 ait sshd[243331]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  5 00:29:16 ait sshd[243331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.2.133.209
description:
[2025-02-05 00:28:53 +0100] info [cpaneld] 182.2.133.209 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Feb  5 00:28:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
description:
Feb  5 00:29:03 ait sshd[243313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-29.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.149.47.88
description:
[2025-02-05 00:30:02 +0100] info [webmaild] 200.149.47.88 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  5 00:30:13 ait sshd[243762]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 00:30:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.188.31.98
description:
[2025-02-05 00:29:33 +0100] info [webmaild] 177.188.31.98 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  5 00:30:13 ait sshd[243762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 00:30:16 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:63280: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 00:30:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
description:
Feb  5 00:29:51 ait sshd[243547]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
description:
Feb  5 00:29:46 ait sshd[243540]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  5 00:29:46 ait sshd[243540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
description:
Feb  5 00:29:51 ait sshd[243547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Feb  5 00:30:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-02-05 00:30:29 dovecot_plain authenticator failed for ([38.49.182.103]) [38.49.182.103]:57368: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Feb  5 00:30:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.73.94
description:
[2025-02-05 00:30:32 +0100] info [webmaild] 177.8.73.94 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  5 00:30:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-05 00:30:59 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:44468: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Feb  5 00:30:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-02-05 00:30:34 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:59706: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Feb  5 00:31:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.84.107.245
description:
Feb  5 00:31:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.84.107.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.151.186.98
description:
[2025-02-05 00:31:29 +0100] info [webmaild] 89.151.186.98 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-02-05 00:30:34 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:54366: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 00:30:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Feb  5 00:30:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Feb  5 00:31:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-02-05 00:31:12 dovecot_plain authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:32928: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-02-05 00:31:22 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:56320: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-02-05 00:30:53 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:60833: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.84.107.245
description:
2025-02-05 00:31:24 dovecot_login authenticator failed for ([220.84.107.245]) [220.84.107.245]:57152: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Feb  5 00:31:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Feb  5 00:32:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.173.106.95
description:
Feb  5 00:32:28 ait sshd[244642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.173.106.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.173.106.95
description:
Feb  5 00:32:28 ait sshd[244642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.173.106.95


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-02-05 00:31:33 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:53390: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.34.10
description:
Feb  5 00:31:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.34.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.34.10
description:
2025-02-05 00:31:48 dovecot_plain authenticator failed for ([183.236.34.10]) [183.236.34.10]:46728: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.141.206
description:
[2025-02-05 00:32:15 +0100] info [webmaild] 170.231.141.206 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-02-05 00:32:23 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:41386: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Feb  5 00:32:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
description:
2025-02-05 00:32:57 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:37954: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.173.106.95
description:
Feb  5 00:32:31 ait sshd[244642]: Failed password for invalid user dispatch from 157.173.106.95 port 47124 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
description:
Feb  5 00:32:37 ait sshd[244819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  5 00:32:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-05 00:32:42 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:54017: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
description:
2025-02-05 00:32:52 dovecot_plain authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:33530: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.235.203
description:
2025-02-05 00:33:27 dovecot_login authenticator failed for p101203-obmd01.tokyo.ocn.ne.jp [124.101.235.203]:54220: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-02-05 00:32:38 dovecot_login authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:44776: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
description:
2025-02-05 00:33:02 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:46228: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Feb  5 00:33:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.70.142
description:
Feb  5 00:32:32 ait sshd[244662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.70.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
description:
Feb  5 00:33:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.160
description:
2025-02-05 00:33:27 dovecot_login authenticator failed for ([104.241.228.160]) [104.241.228.160]:38048: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
description:
Feb  5 00:32:37 ait sshd[244819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-05 00:32:39 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:41976: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.160
description:
Feb  5 00:33:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.235.203
description:
Feb  5 00:33:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.235.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.70.142
description:
Feb  5 00:32:32 ait sshd[244662]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.21.90
description:
[2025-02-05 00:33:05 +0100] info [webmaild] 187.183.21.90 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
description:
2025-02-05 00:32:33 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:28451: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  5 00:32:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.211.97.51
description:
Feb  5 00:32:45 ait sshd[244857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.211.97.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
description:
Feb  5 00:32:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-02-05 00:32:55 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:58904: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.253
description:
Feb  5 00:33:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-02-05 00:33:12 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:60032: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
description:
Feb  5 00:32:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.97.51
description:
Feb  5 00:32:45 ait sshd[244857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.211.97.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
description:
Feb  5 00:32:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Feb  5 00:32:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.253
description:
2025-02-05 00:33:11 dovecot_plain authenticator failed for ([27.45.233.253]) [27.45.233.253]:58324: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.9.68.2
description:
[2025-02-05 00:32:35 +0100] info [webmaild] 190.9.68.2 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.159.141
description:
Feb  5 00:34:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.159.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.98.249.9
description:
Feb  5 00:34:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.98.249.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Feb  5 00:34:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.133
description:
Feb  5 00:34:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  5 00:34:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-02-05 00:34:21 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:51810: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
description:
Feb  5 00:34:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.56.216
description:
2025-02-05 00:34:28 dovecot_plain authenticator failed for ([185.137.56.216]) [185.137.56.216]:39800: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.221.48
description:
Feb  5 00:33:40 ait sshd[245121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.221.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-02-05 00:34:17 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:33174: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.159.141
description:
2025-02-05 00:34:19 dovecot_plain authenticator failed for ([115.20.159.141]) [115.20.159.141]:53583: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-02-05 00:34:25 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:38246: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.105.182.88
description:
2025-02-05 00:33:41 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:48720: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Feb  5 00:34:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-02-05 00:34:19 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:51128: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Feb  5 00:33:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Feb  5 00:33:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
description:
Feb  5 00:34:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Feb  5 00:34:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
description:
2025-02-05 00:34:16 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:60399: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-05 00:34:19 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:39982: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-02-05 00:34:22 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:48140: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.186
description:
Feb  5 00:33:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.186
description:
2025-02-05 00:33:46 dovecot_login authenticator failed for ([111.61.177.186]) [111.61.177.186]:41772: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.2.144
description:
[2025-02-05 00:34:09 +0100] info [webmaild] 131.255.2.144 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.222.84
description:
Feb  5 00:34:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.222.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  5 00:34:27 ait sshd[245433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
description:
2025-02-05 00:33:55 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:50421: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.98.249.9
description:
2025-02-05 00:34:10 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:58901: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  5 00:34:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-02-05 00:34:17 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:36416: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.222.84
description:
2025-02-05 00:34:25 dovecot_plain authenticator failed for ([183.234.222.84]) [183.234.222.84]:59109: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-02-05 00:34:28 dovecot_login authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:56306: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Feb  5 00:34:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Feb  5 00:34:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Feb  5 00:34:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  5 00:34:27 ait sshd[245433]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.221.48
description:
Feb  5 00:33:40 ait sshd[245121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.221.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
description:
2025-02-05 00:34:04 dovecot_plain authenticator failed for (ondergater) [65.20.149.93]:57652: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
description:
Feb  5 00:34:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Feb  5 00:34:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-02-05 00:33:41 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:8338: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Feb  5 00:33:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.133
description:
2025-02-05 00:34:27 dovecot_login authenticator failed for ([104.241.236.133]) [104.241.236.133]:55893: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Feb  5 00:34:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
description:
2025-02-05 00:34:29 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:46302: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.137.56.216
description:
Feb  5 00:34:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.137.56.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Feb  5 00:34:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Feb  5 00:33:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-02-05 00:33:55 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:36904: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  5 00:34:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-05 00:34:46 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:43488: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.28.222
description:
[2025-02-05 00:35:12 +0100] info [webmaild] 170.244.28.222 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Feb  5 00:34:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  5 00:34:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.83.205
description:
2025-02-05 00:34:45 dovecot_login authenticator failed for ([94.205.83.205]) [94.205.83.205]:46182: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Feb  5 00:34:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-02-05 00:34:37 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:56825: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.11.200.247
description:
[2025-02-05 00:34:43 +0100] info [webmaild] 45.11.200.247 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  5 00:34:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-02-05 00:34:32 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:55574: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
description:
2025-02-05 00:34:42 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:34641: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-02-05 00:34:31 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:60429: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Feb  5 00:34:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-05 00:34:32 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:41665: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Feb  5 00:34:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.83.205
description:
Feb  5 00:34:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.7.109.160
description:
Feb  5 00:35:17 ait sshd[245876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.7.109.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-02-05 00:34:31 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:58860: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-02-05 00:34:33 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:43689: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 00:34:50 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:37962: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Feb  5 00:35:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Feb  5 00:34:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Feb  5 00:34:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Feb  5 00:34:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-05 00:34:45 dovecot_login authenticator failed for ([59.98.150.190]) [122.160.68.46]:46672: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-02-05 00:34:36 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:20691: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-02-05 00:34:44 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:3082: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  5 00:34:46 ait sshd[245618]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Feb  5 00:35:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Feb  5 00:34:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.148.248.242
description:
Feb  5 00:34:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.148.248.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Feb  5 00:35:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.170.35.50
description:
2025-02-05 00:35:03 dovecot_plain authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:47088: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Feb  5 00:35:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-02-05 00:34:34 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:57584: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-02-05 00:34:42 dovecot_login authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:38804: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-02-05 00:34:43 dovecot_login authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:45352: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  5 00:34:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Feb  5 00:34:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.148.248.242
description:
2025-02-05 00:34:40 dovecot_plain authenticator failed for ([117.148.248.242]) [117.148.248.242]:42488: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-02-05 00:35:18 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:36412: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-02-05 00:35:22 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:41507: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-02-05 00:34:36 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:52374: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  5 00:34:46 ait sshd[245618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.170.35.50
description:
Feb  5 00:35:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.170.35.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-02-05 00:35:12 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:47972: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.72
description:
47.128.118.72 - - [05/Feb/2025:00:35:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=1047656 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=125%2C106%2C205%2C61&filter_course-language=198%2C95%2C99&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.72


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.7.109.160
description:
Feb  5 00:35:17 ait sshd[245876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.7.109.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-02-05 00:35:23 dovecot_login authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:46206: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Feb  5 00:36:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-02-05 00:35:44 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:59788: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-02-05 00:35:54 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:40129: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  5 00:35:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Feb  5 00:36:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Feb  5 00:35:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Feb  5 00:35:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.34.17.130
description:
Feb  5 00:35:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.34.17.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Feb  5 00:35:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.74.239
description:
[2025-02-05 00:35:42 +0100] info [webmaild] 177.55.74.239 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Feb  5 00:35:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  5 00:36:04 ait sshd[246364]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-02-05 00:36:14 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:60845: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  5 00:36:04 ait sshd[246364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-02-05 00:36:08 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:40847: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.66.222
description:
Feb  5 00:35:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.66.222
description:
2025-02-05 00:35:34 dovecot_login authenticator failed for ([94.204.66.222]) [94.204.66.222]:34305: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-05 00:35:56 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:51622: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
description:
2025-02-05 00:35:57 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:47451: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-02-05 00:35:41 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:42054: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-02-05 00:36:00 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:44372: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Feb  5 00:35:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-02-05 00:35:32 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:60722: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Feb  5 00:36:49 ait sshd[246575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-02-05 00:36:50 dovecot_plain authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:43833: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.63.199
description:
47.128.63.199 - - [05/Feb/2025:00:36:51 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20760246 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=95%2C79&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.63.199


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.0.218
description:
Feb  5 00:37:30 ait sshd[246671]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.154.0.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.62.182.156
description:
[2025-02-05 00:36:41 +0100] info [webmaild] 167.62.182.156 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
description:
Feb  5 00:36:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.154.0.218
description:
Feb  5 00:37:30 ait sshd[246671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.0.218  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.88.106
description:
Feb  5 00:36:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.88.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.88.106
description:
2025-02-05 00:36:32 dovecot_plain authenticator failed for ([117.158.88.106]) [117.158.88.106]:11269: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Feb  5 00:36:49 ait sshd[246575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.46.150
description:
[2025-02-05 00:37:16 +0100] info [webmaild] 170.238.46.150 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-05 00:38:19 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:35429: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.32.50.39
description:
[2025-02-05 00:37:44 +0100] info [webmaild] 190.32.50.39 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.82.196.131
description:
2025-02-05 00:38:02 dovecot_plain authenticator failed for ([120.82.196.131]) [120.82.196.131]:37079: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.153.45
description:
Feb  5 00:38:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.153.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 00:37:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.82.196.131
description:
Feb  5 00:38:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.82.196.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
description:
Feb  5 00:38:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.153.42
description:
[2025-02-05 00:38:13 +0100] info [webmaild] 168.228.153.42 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
description:
2025-02-05 00:38:14 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:49924: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.127.120
description:
47.128.127.120 - - [05/Feb/2025:00:38:29 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26286227 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C99%2C95%2C120&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.127.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.150
description:
Feb  5 00:38:00 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
description:
2025-02-05 00:38:02 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:35686: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Feb  5 00:38:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.111.246.153
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-37.95.111.246.153


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.82.191
description:
[2025-02-05 00:39:18 +0100] info [webmaild] 177.93.82.191 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 00:38:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-02-05 00:39:59 dovecot_login authenticator failed for ([195.252.209.189]) [195.252.209.189]:46242: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Feb  5 00:39:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
description:
Feb  5 00:39:47 ait sshd[247203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.143.145.110
description:
[2025-02-05 00:39:52 +0100] info [webmaild] 85.143.145.110 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 00:40:17 ait sshd[247673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-02-05 00:39:47 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:39638: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.3.99.61
description:
[2025-02-05 00:40:30 +0100] info [webmaild] 188.3.99.61 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
description:
Feb  5 00:39:47 ait sshd[247203]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Feb  5 00:39:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
description:
Feb  5 00:40:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
description:
2025-02-05 00:40:55 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:36692: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
description:
Feb  5 00:40:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-02-05 00:40:59 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:54467: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-05 00:40:47 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:35840: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.122
description:
2025-02-05 00:40:47 dovecot_login authenticator failed for ([61.185.226.122]) [61.185.226.122]:55671: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-02-05 00:40:54 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:55524: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Feb  5 00:41:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Feb  5 00:41:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.200.154.39
description:
Feb  5 00:41:23 ait sshd[248194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.200.154.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-02-05 00:40:36 dovecot_login authenticator failed for ([94.204.230.214]) [94.204.230.214]:56002: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  5 00:40:44 ait sshd[247977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-02-05 00:41:06 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:40150: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Feb  5 00:40:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.116
description:
2025-02-05 00:40:49 dovecot_plain authenticator failed for st7028.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.116]:49222: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  5 00:41:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Feb  5 00:41:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.122
description:
Feb  5 00:40:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.116
description:
Feb  5 00:40:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  5 00:40:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.170.81
description:
Feb  5 00:41:15 ait sshd[248195]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.170.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
description:
Feb  5 00:40:44 ait sshd[247977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.37
description:
2025-02-05 00:40:56 dovecot_plain authenticator failed for (m121-202-206-37.smartone.com) [121.202.206.37]:48450: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.96.82.45
description:
[2025-02-05 00:40:59 +0100] info [webmaild] 102.96.82.45 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-05 00:41:06 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:48102: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-02-05 00:41:09 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:60160: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.165.222
description:
2025-02-05 00:41:10 dovecot_plain authenticator failed for ([183.247.165.222]) [183.247.165.222]:47447: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-02-05 00:41:12 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:52570: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  5 00:40:35 ait sshd[247865]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  5 00:40:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-05 00:40:41 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:49406: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-02-05 00:40:43 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:44109: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Feb  5 00:40:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Feb  5 00:40:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Feb  5 00:41:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.165.222
description:
Feb  5 00:41:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Feb  5 00:40:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  5 00:40:35 ait sshd[247865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-05 00:40:52 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:44991: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.37
description:
Feb  5 00:40:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.170.81
description:
Feb  5 00:41:15 ait sshd[248195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.170.81


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.200.154.39
description:
Feb  5 00:41:23 ait sshd[248194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.200.154.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-02-05 00:41:26 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:49044: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-02-05 00:41:48 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:54821: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
description:
2025-02-05 00:41:49 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:42670: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.199.21
description:
Feb  5 00:41:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.199.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
description:
2025-02-05 00:41:52 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:51300: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-02-05 00:42:11 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:15495: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
description:
Feb  5 00:41:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
description:
2025-02-05 00:41:47 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:36250: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
description:
Feb  5 00:41:51 ait sshd[248452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Feb  5 00:41:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Feb  5 00:41:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
description:
Feb  5 00:41:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Feb  5 00:41:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 00:42:09 dovecot_plain authenticator failed for (58.69.17.18.pldt.net) [58.69.17.18]:42760: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Feb  5 00:42:29 ait sshd[248580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.34
description:
Feb  5 00:41:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.234
description:
Feb  5 00:41:51 ait sshd[248452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.71.27.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-05 00:42:00 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:38718: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-02-05 00:42:01 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:37805: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-02-05 00:42:03 dovecot_plain authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:43239: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
description:
Feb  5 00:42:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Feb  5 00:41:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  5 00:41:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
description:
Feb  5 00:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Feb  5 00:41:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
description:
2025-02-05 00:41:47 dovecot_login authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:51176: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Feb  5 00:41:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
description:
2025-02-05 00:41:52 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:41768: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-02-05 00:41:55 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:38594: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Feb  5 00:42:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
description:
2025-02-05 00:41:53 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:51348: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
description:
Feb  5 00:41:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
description:
Feb  5 00:42:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-02-05 00:42:03 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:34286: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-02-05 00:41:49 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:58370: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-02-05 00:41:53 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:44078: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-02-05 00:41:57 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:35748: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
description:
2025-02-05 00:42:03 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:24494: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.71.140.70
description:
[2025-02-05 00:42:13 +0100] info [webmaild] 185.71.140.70 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
description:
Feb  5 00:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.136.29
description:
2025-02-05 00:42:01 dovecot_plain authenticator failed for ipb219881d.dynamic.kabel-deutschland.de [178.25.136.29]:39556: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Feb  5 00:41:36 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-02-05 00:41:43 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:46985: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
description:
2025-02-05 00:41:52 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:43126: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.175.122
description:
2025-02-05 00:42:08 dovecot_plain authenticator failed for ([120.236.175.122]) [120.236.175.122]:35878: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
description:
Feb  5 00:41:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
description:
Feb  5 00:41:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Feb  5 00:42:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.13.143
description:
Feb  5 00:42:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.13.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.177.55
description:
2025-02-05 00:42:07 dovecot_plain authenticator failed for ([209.141.177.55]) [209.141.177.55]:37091: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.249.36.3
description:
2025-02-05 00:42:03 dovecot_plain authenticator failed for ([183.71.251.66]) [113.249.36.3]:19165: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-02-05 00:42:09 dovecot_plain authenticator failed for ([61.51.184.194]) [61.51.184.194]:57275: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-02-05 00:42:20 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:39916: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  5 00:42:29 ait sshd[248580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Feb  5 00:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-02-05 00:41:48 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:49951: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
description:
2025-02-05 00:41:49 dovecot_plain authenticator failed for ([61.184.119.61]) [61.184.119.61]:58375: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
description:
Feb  5 00:41:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.136.29
description:
Feb  5 00:41:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.136.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.13.143
description:
2025-02-05 00:42:05 dovecot_plain authenticator failed for ([39.152.13.143]) [39.152.13.143]:48633: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.239.241.198
description:
Feb  5 00:41:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.239.241.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Feb  5 00:41:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-05 00:41:55 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:59265: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
description:
2025-02-05 00:41:56 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:45418: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-02-05 00:42:03 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:7648: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-02-05 00:42:07 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:51098: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-05 00:42:18 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:46814: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-02-05 00:41:38 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:60697: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-02-05 00:41:44 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:36753: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
description:
Feb  5 00:41:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-02-05 00:41:55 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:59312: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Feb  5 00:41:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Feb  5 00:42:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-02-05 00:41:52 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:49328: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.199.21
description:
2025-02-05 00:41:53 dovecot_plain authenticator failed for ([103.163.199.21]) [103.163.199.21]:57724: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-02-05 00:42:11 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (grendireal) [81.16.170.117]:43702: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.104.221.252
description:
Feb  5 00:42:17 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.104.221.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Feb  5 00:42:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-02-05 00:41:48 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:54548: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-02-05 00:41:57 dovecot_plain authenticator failed for ([82.84.122.203]) [82.84.122.203]:60522: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
description:
2025-02-05 00:42:00 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:32931: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.141.177.55
description:
Feb  5 00:42:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.141.177.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Feb  5 00:41:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Feb  5 00:41:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Feb  5 00:42:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-05 00:42:16 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:49226: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.221.252
description:
2025-02-05 00:42:19 dovecot_plain authenticator failed for ([210.104.221.252]) [210.104.221.252]:33751: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  5 00:42:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Feb  5 00:41:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
description:
Feb  5 00:41:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Feb  5 00:41:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Feb  5 00:42:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.106.187
description:
Feb  5 00:42:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.106.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-02-05 00:42:05 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:52914: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
description:
Feb  5 00:42:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-05 00:41:45 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:34470: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.28.61
description:
2025-02-05 00:41:48 dovecot_plain authenticator failed for ([60.173.88.145]) [111.39.28.61]:38186: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
description:
2025-02-05 00:42:03 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:52170: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.118
description:
Feb  5 00:42:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.175.122
description:
Feb  5 00:42:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Feb  5 00:41:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
description:
Feb  5 00:41:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-02-05 00:41:52 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:41146: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-02-05 00:41:59 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:57140: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-02-05 00:41:44 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:53803: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.28.61
description:
Feb  5 00:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-02-05 00:41:54 dovecot_plain authenticator failed for (dynamicip-95-79-20-9.pppoe.nn.ertelecom.ru) [95.79.20.9]:59968: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
description:
Feb  5 00:42:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
description:
Feb  5 00:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-02-05 00:42:01 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:43150: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
description:
2025-02-05 00:42:04 dovecot_plain authenticator failed for ([65.76.106.187]) [65.76.106.187]:56256: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 00:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
description:
Feb  5 00:41:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
description:
Feb  5 00:41:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
description:
Feb  5 00:41:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
description:
Feb  5 00:41:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
description:
2025-02-05 00:41:49 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:54610: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-02-05 00:42:15 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:42124: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-02-05 00:42:16 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:32354: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-05 00:42:06 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:37597: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Feb  5 00:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
description:
2025-02-05 00:41:45 dovecot_plain authenticator failed for ([1.26.70.70]) [1.26.70.70]:35081: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  5 00:41:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-02-05 00:41:53 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:33093: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
description:
Feb  5 00:41:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
description:
2025-02-05 00:41:56 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:45567: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Feb  5 00:42:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
description:
2025-02-05 00:42:11 dovecot_plain authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:49756: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  5 00:42:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  5 00:42:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Feb  5 00:41:34 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.230.142
description:
Feb  5 00:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.230.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
description:
2025-02-05 00:41:48 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:47182: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
description:
Feb  5 00:42:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Feb  5 00:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-02-05 00:42:11 dovecot_plain authenticator failed for ([201.98.208.115]) [201.98.208.115]:48551: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-02-05 00:41:36 dovecot_login authenticator failed for ([178.178.194.128]) [178.178.194.128]:52426: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Feb  5 00:41:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-02-05 00:41:59 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:57496: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
description:
2025-02-05 00:42:12 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:50714: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.230.142
description:
2025-02-05 00:41:48 dovecot_plain authenticator failed for ([60.191.230.142]) [60.191.230.142]:41254: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.220.235
description:
Feb  5 00:41:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.220.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
description:
2025-02-05 00:41:50 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:50192: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-02-05 00:42:04 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:46738: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Feb  5 00:42:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.106.136.152
description:
Feb  5 00:42:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.106.136.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.106.136.152
description:
2025-02-05 00:42:10 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:52988: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.239.241.198
description:
2025-02-05 00:41:49 dovecot_plain authenticator failed for ([115.239.241.198]) [115.239.241.198]:49558: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
description:
2025-02-05 00:41:52 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:38723: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  5 00:41:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Feb  5 00:42:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Feb  5 00:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
description:
2025-02-05 00:41:48 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:35064: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
description:
2025-02-05 00:41:53 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:49387: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Feb  5 00:41:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.249.36.3
description:
Feb  5 00:42:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.249.36.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Feb  5 00:42:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Feb  5 00:42:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  5 00:41:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-05 00:41:44 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:53305: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-02-05 00:41:46 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:48692: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
description:
Feb  5 00:41:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  5 00:42:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
description:
2025-02-05 00:42:03 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:46716: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.89.118
description:
2025-02-05 00:42:08 dovecot_plain authenticator failed for ([196.0.89.118]) [196.0.89.118]:58164: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
description:
Feb  5 00:41:46 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Feb  5 00:41:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Feb  5 00:41:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-02-05 00:42:07 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:60816: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Feb  5 00:42:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Feb  5 00:42:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 00:42:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.59.34.245
description:
Feb  5 00:42:46 ait sshd[248715]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.59.34.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Feb  5 00:43:25 ait sshd[248832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
description:
2025-02-05 00:42:31 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:41516: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.59.34.245
description:
Feb  5 00:42:46 ait sshd[248715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.59.34.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.195.43
description:
[2025-02-05 00:42:53 +0100] info [webmaild] 168.195.195.43 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-02-05 00:43:15 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:59052: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.207
description:
Feb  5 00:42:30 ait sshd[248579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-02-05 00:42:39 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:58444: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.12.150.150
description:
[2025-02-05 00:43:03 +0100] info [webmaild] 190.12.150.150 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.207
description:
Feb  5 00:42:30 ait sshd[248579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.207 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.120.58.228
description:
Feb  5 00:42:31 ait sshd[248580]: Failed password for invalid user compras from 116.120.58.228 port 44022 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-05 00:42:31 dovecot_plain authenticator failed for ([179.181.133.153]) [179.181.133.153]:35292: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Feb  5 00:43:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Feb  5 00:43:25 ait sshd[248832]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-43.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
description:
2025-02-05 00:44:05 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:45309: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
description:
2025-02-05 00:44:29 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:36776: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  5 00:44:05 ait sshd[249253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
description:
2025-02-05 00:44:22 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:37998: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.14.169
description:
[2025-02-05 00:43:36 +0100] info [webmaild] 170.244.14.169 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-05 00:43:41 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:60182: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
description:
2025-02-05 00:44:13 dovecot_plain authenticator failed for ([211.243.43.30]) [211.243.43.30]:57008: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-02-05 00:44:07 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:42073: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-02-05 00:44:12 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:56108: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
description:
Feb  5 00:44:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 00:44:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  5 00:43:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
description:
Feb  5 00:44:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.57.60
description:
Feb  5 00:44:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.57.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  5 00:44:05 ait sshd[249230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
description:
2025-02-05 00:44:16 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:56382: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 00:44:21 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:56296: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Feb  5 00:44:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  5 00:44:05 ait sshd[249253]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-02-05 00:44:11 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:54319: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.148.106
description:
Feb  5 00:44:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.148.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
description:
Feb  5 00:44:20 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
description:
Feb  5 00:44:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  5 00:44:05 ait sshd[249230]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Feb  5 00:44:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Feb  5 00:44:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
description:
2025-02-05 00:44:21 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:38627: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.78
description:
Feb  5 00:45:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.128.78
description:
2025-02-05 00:45:16 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:45895: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
description:
Feb  5 00:44:50 ait sshd[249452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
description:
Feb  5 00:45:12 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-02-05 00:45:29 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:53362: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  5 00:45:25 ait sshd[249707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.70.169
description:
Feb  5 00:44:40 ait sshd[249323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.70.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
description:
Feb  5 00:44:50 ait sshd[249452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-45.202.29.30.124


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  5 00:45:25 ait sshd[249707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Feb  5 00:45:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.70.169
description:
Feb  5 00:44:40 ait sshd[249323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.70.169


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.207.70
description:
[2025-02-05 00:45:00 +0100] info [webmaild] 45.177.207.70 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
description:
2025-02-05 00:45:14 dovecot_plain authenticator failed for (ANO-SH-21.Moscow.access.comstar.ru) [83.237.42.54]:54446: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
description:
Feb  5 00:46:22 ait sshd[250196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
description:
Feb  5 00:45:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
description:
2025-02-05 00:45:49 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:58995: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 00:46:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
description:
Feb  5 00:46:12 ait sshd[250180]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:00-45.202.29.30.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.34.199
description:
[2025-02-05 00:45:38 +0100] info [webmaild] 170.233.34.199 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-05 00:45:34 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:34283: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 00:46:10 ait sshd[250176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.10.61.254
description:
[2025-02-05 00:46:13 +0100] info [webmaild] 177.10.61.254 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
description:
Feb  5 00:46:22 ait sshd[250196]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.232.19.79
description:
Feb  5 00:45:43 ait sshd[249968]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.232.19.79 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  5 00:46:17 ait sshd[250187]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.225.109.30
description:
Feb  5 00:46:06 ait sshd[250141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.109.30


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  5 00:46:12 ait sshd[250180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  5 00:45:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-02-05 00:45:37 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:47427: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.96.54.118
description:
[2025-02-05 00:45:54 +0100] info [webmaild] 102.96.54.118 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.109.30
description:
Feb  5 00:46:06 ait sshd[250141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.225.109.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
description:
Feb  5 00:45:31 ait sshd[249923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
description:
Feb  5 00:45:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.113.61.126
description:
Feb  5 00:46:05 ait sshd[250143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.113.61.126


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 00:46:10 ait sshd[250176]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  5 00:45:31 ait sshd[249923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.232.19.79
description:
Feb  5 00:45:43 ait sshd[249968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.232.19.79


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.113.61.126
description:
Feb  5 00:46:05 ait sshd[250143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.113.61.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Feb  5 00:46:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 00:47:20 ait sshd[250486]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-02-05 00:46:51 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:34909: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.10
description:
Feb  5 00:47:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.176.50
description:
2025-02-05 00:47:07 dovecot_login authenticator failed for ([124.115.176.50]) [124.115.176.50]:53898: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Feb  5 00:46:49 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 00:47:20 ait sshd[250486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.210
description:
Feb  5 00:46:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-02-05 00:46:55 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:34169: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-02-05 00:46:59 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:38023: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  5 00:47:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
description:
Feb  5 00:47:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
description:
2025-02-05 00:47:24 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:36480: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.18.2
description:
Feb  5 00:47:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.18.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.18.2
description:
2025-02-05 00:47:08 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.18.2]:56544: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Feb  5 00:46:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-02-05 00:46:49 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:53716: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Feb  5 00:46:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-02-05 00:47:05 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:35856: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Feb  5 00:47:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.210
description:
2025-02-05 00:46:45 dovecot_login authenticator failed for ([61.185.226.210]) [61.185.226.210]:49456: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.176.50
description:
Feb  5 00:47:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.176.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-02-05 00:47:18 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:49912: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Feb  5 00:47:03 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.10
description:
2025-02-05 00:47:07 dovecot_login authenticator failed for ([104.241.238.10]) [104.241.238.10]:34248: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
description:
2025-02-05 00:47:21 dovecot_login authenticator failed for ([20.239.187.13]) [20.239.187.13]:47668: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
description:
Feb  5 00:47:54 ait sshd[250755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
description:
Feb  5 00:47:55 ait sshd[250758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.142.226.218
description:
2025-02-05 00:47:49 dovecot_login authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [14.142.226.218]:41656: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-02-05 00:47:49 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:43129: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-02-05 00:47:49 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:34034: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.128.5
description:
Feb  5 00:48:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.128.5 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.1
description:
47.128.36.1 - - [05/Feb/2025:00:47:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=1964991 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?filter_course-language=79&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.229.19.193
description:
Feb  5 00:48:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.229.19.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
description:
Feb  5 00:48:30 ait sshd[250829]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-02-05 00:48:00 dovecot_login authenticator failed for ([178.72.83.179]) [178.72.83.179]:58362: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Feb  5 00:47:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Feb  5 00:48:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.25.192
description:
[2025-02-05 00:48:27 +0100] info [webmaild] 191.37.25.192 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
description:
Feb  5 00:48:30 ait sshd[250829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.242.58
description:
[2025-02-05 00:47:40 +0100] info [webmaild] 179.125.242.58 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Feb  5 00:48:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.229.19.193
description:
2025-02-05 00:48:12 dovecot_login authenticator failed for ([45.229.19.193]) [45.229.19.193]:60994: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-02-05 00:48:12 dovecot_login authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:51353: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 197.243.16.120
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-48.197.243.16.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-02-05 00:47:34 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:23808: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.142.226.218
description:
Feb  5 00:47:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.142.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-02-05 00:48:15 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:36578: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.93.166.79
description:
[2025-02-05 00:48:17 +0100] info [webmaild] 179.93.166.79 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Feb  5 00:47:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Feb  5 00:47:47 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
description:
Feb  5 00:47:55 ait sshd[250758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Feb  5 00:47:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
description:
2025-02-05 00:48:03 dovecot_login authenticator failed for ([170.250.128.5]) [170.250.128.5]:46162: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
description:
Feb  5 00:47:54 ait sshd[250755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.78
description:
Feb  5 00:48:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-02-05 00:48:45 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:54296: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.105.104.168
description:
Feb  5 00:48:49 ait sshd[250889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.105.104.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-02-05 00:48:55 dovecot_login authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:38931: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Feb  5 00:49:06 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Feb  5 00:49:16 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.134
description:
Feb  5 00:49:23 ait sshd[251076]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Feb  5 00:48:52 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Feb  5 00:48:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
description:
2025-02-05 00:49:07 dovecot_login authenticator failed for ([103.123.114.215]) [103.123.114.215]:58954: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-02-05 00:49:08 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:35117: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-02-05 00:49:18 dovecot_login authenticator failed for ([201.218.181.19]) [201.218.181.19]:50202: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
description:
Feb  5 00:48:38 ait sshd[250862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-02-05 00:48:54 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:4237: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.105.246.224
description:
Feb  5 00:48:32 ait sshd[250829]: Failed password for invalid user tina from 23.105.246.224 port 47256 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  5 00:48:33 ait sshd[250850]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.36.162.1
description:
[2025-02-05 00:49:00 +0100] info [webmaild] 187.36.162.1 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  5 00:48:33 ait sshd[250850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.114.215
description:
Feb  5 00:49:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.114.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.134
description:
Feb  5 00:49:23 ait sshd[251076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.78
description:
2025-02-05 00:48:35 dovecot_login authenticator failed for ([183.204.41.78]) [183.204.41.78]:43237: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
description:
Feb  5 00:48:38 ait sshd[250862]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
description:
Feb  5 00:48:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
description:
Feb  5 00:49:00 ait sshd[251022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.105.104.168
description:
Feb  5 00:48:49 ait sshd[250889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.104.168


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
description:
Feb  5 00:49:00 ait sshd[251022]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.213.193.49
description:
2025-02-05 00:50:05 dovecot_login authenticator failed for ([103.213.193.49]) [103.213.193.49]:3569: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.46.20
description:
Feb  5 00:50:08 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.46.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.46.20
description:
2025-02-05 00:50:10 dovecot_login authenticator failed for p285021-obmd01.tokyo.ocn.ne.jp [153.141.46.20]:48776: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.79.235.255
domain: lemsas.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/admin/upload/css.php||SC:/home/lemsas/public_html/admin


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 13.79.235.255
domain: lemsas.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:00-49.13.79.235.255||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.198.73
description:
Feb  5 00:49:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.198.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.21
description:
Feb  5 00:50:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  5 00:49:36 ait sshd[251111]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.21
description:
2025-02-05 00:50:03 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:52499: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-02-05 00:50:26 dovecot_login authenticator failed for ([111.124.47.11]) [111.124.47.11]:57963: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.95.108.193
description:
[2025-02-05 00:50:20 +0100] info [webmaild] 187.95.108.193 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  5 00:49:36 ait sshd[251111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.228.168.90
description:
Feb  5 00:49:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.228.168.90 has been locked due to Imunify RBL


