# incident

plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.103.38
description:
Feb  5 03:37:06 ait sshd[317202]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.103.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.103.38
description:
Feb  5 03:37:06 ait sshd[317202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.103.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Feb  5 03:37:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.96.116.244
description:
[2025-02-05 03:38:02 +0100] info [webmaild] 41.96.116.244 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 03:38:12 ait sshd[317516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.65.46
description:
Feb  5 03:38:14 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.65.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  5 03:38:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.90.89.66
description:
Feb  5 03:38:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.90.89.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.236.214
description:
Feb  5 03:38:30 ait sshd[317576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.236.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.196.221.74
description:
2025-02-05 03:38:09 dovecot_plain authenticator failed for ([159.196.221.74]) [159.196.221.74]:2669: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  5 03:38:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
description:
2025-02-05 03:38:16 dovecot_login authenticator failed for (est.giport.ru) [82.208.65.46]:3361: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-05 03:38:21 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:56813: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.236.214
description:
Feb  5 03:38:30 ait sshd[317576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.236.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Feb  5 03:38:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-02-05 03:38:04 dovecot_login authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:34340: 535 Incorrect authentication data (set_id=mail@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.196.221.74
description:
Feb  5 03:38:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.196.221.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 03:38:12 ait sshd[317516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-05 03:38:13 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:37640: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
description:
2025-02-05 03:38:25 dovecot_plain authenticator failed for ([66.90.89.66]) [66.90.89.66]:55068: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
description:
Feb  5 03:39:26 ait sshd[317995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  5 03:39:11 ait sshd[317847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.247.110.166
description:
[2025-02-05 03:39:14 +0100] info [webmaild] 190.247.110.166 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.251.51
description:
[2025-02-05 03:39:44 +0100] info [webmaild] 177.37.251.51 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  5 03:39:11 ait sshd[317847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.27.5
description:
Feb  5 03:39:23 ait sshd[317988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.27.5


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
description:
Feb  5 03:39:26 ait sshd[317995]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 03:39:57 ait sshd[318086]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.27.5
description:
Feb  5 03:39:23 ait sshd[317988]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.27.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 03:39:57 ait sshd[318086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.91.123.84
description:
[2025-02-05 03:40:04 +0100] info [webmaild] 200.91.123.84 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
description:
Feb  5 03:40:52 ait sshd[318560]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.110.200.43
description:
Feb  5 03:39:59 ait sshd[318086]: Failed password for invalid user management from 183.110.200.43 port 50040 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 03:40:37 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.206.18
description:
[2025-02-05 03:40:40 +0100] info [webmaild] 177.54.206.18 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
description:
Feb  5 03:40:52 ait sshd[318560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  5 03:40:59 ait sshd[318577]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Feb  5 03:41:13 ait sshd[318632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-02-05 03:41:30 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:53864: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.195.15
description:
[2025-02-05 03:41:50 +0100] info [webmaild] 198.163.195.15 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.170
description:
Feb  5 03:41:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Feb  5 03:41:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Feb  5 03:41:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-02-05 03:41:28 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:48430: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  5 03:40:59 ait sshd[318577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.170
description:
2025-02-05 03:41:11 dovecot_plain authenticator failed for ([220.77.182.170]) [220.77.182.170]:39667: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Feb  5 03:41:13 ait sshd[318632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  5 03:41:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-05 03:41:17 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:37856: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.56.18.8
description:
Feb  5 03:42:09 ait sshd[319025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.56.18.8


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.123.77
description:
47.128.123.77 - - [05/Feb/2025:03:42:48 +0100] "GET /wp-content/themes/edumall/style.css HTTP/2.0" 200 1438 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17532837" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.123.77


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.105.104.168
description:
Feb  5 03:42:19 ait sshd[319199]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.105.104.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.105.104.168
description:
Feb  5 03:42:19 ait sshd[319199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.104.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.140.75.7
description:
[2025-02-05 03:42:20 +0100] info [webmaild] 41.140.75.7 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-42.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.167.32
description:
[2025-02-05 03:42:42 +0100] info [webmaild] 160.238.167.32 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
description:
2025-02-05 03:42:52 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:51312: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.96.151.110
description:
Feb  5 03:42:55 ait sshd[319278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.96.151.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Feb  5 03:42:58 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.96.151.110
description:
Feb  5 03:42:55 ait sshd[319278]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.96.151.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.56.18.8
description:
Feb  5 03:42:09 ait sshd[319025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.56.18.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
description:
Feb  5 03:42:50 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
description:
2025-02-05 03:43:37 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:41307: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Feb  5 03:43:04 ait sshd[319323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Feb  5 03:43:04 ait sshd[319323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
description:
Feb  5 03:43:12 ait sshd[319345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Feb  5 03:43:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.174
description:
Feb  5 03:43:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-02-05 03:43:46 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:32615: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
description:
2025-02-05 03:43:47 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:38431: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-02-05 03:43:00 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:37037: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.112.191
description:
2025-02-05 03:43:30 dovecot_plain authenticator failed for ([223.95.112.191]) [223.95.112.191]:43427: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
description:
Feb  5 03:43:35 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.21
description:
2025-02-05 03:43:09 dovecot_plain authenticator failed for ([93.125.83.110]) [91.149.142.21]:37795: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Feb  5 03:43:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
description:
Feb  5 03:43:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.42.104.163
description:
2025-02-05 03:43:56 dovecot_plain authenticator failed for (212-42-104-163.static.elcat.kg) [212.42.104.163]:39510: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
description:
Feb  5 03:43:12 ait sshd[319345]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
description:
2025-02-05 03:43:26 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:47363: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-02-05 03:43:28 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:50849: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.49.244.133
description:
[2025-02-05 03:43:19 +0100] info [webmaild] 201.49.244.133 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
description:
Feb  5 03:43:24 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
description:
2025-02-05 03:43:35 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:51665: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-05 03:43:03 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:59756: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.149.142.21
description:
Feb  5 03:43:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.149.142.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.112.191
description:
Feb  5 03:43:28 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.112.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.42.104.163
description:
Feb  5 03:43:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.42.104.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  5 03:43:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 03:44:03 ait sshd[319737]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 03:44:03 ait sshd[319737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  5 03:44:14 ait sshd[319790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.121.9
description:
Feb  5 03:44:23 ait sshd[319939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.121.9


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  5 03:44:30 ait sshd[319965]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.192.69.10
description:
2025-02-05 03:44:31 dovecot_plain authenticator failed for ([113.192.69.10]) [113.192.69.10]:37894: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Feb  5 03:44:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-02-05 03:44:15 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:46614: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.121.9
description:
Feb  5 03:44:23 ait sshd[319939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.121.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.192.69.10
description:
Feb  5 03:44:29 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.192.69.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.132.200
description:
Feb  5 03:44:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.132.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 03:44:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  5 03:44:14 ait sshd[319790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.227
description:
[2025-02-05 03:44:22 +0100] info [webmaild] 213.230.87.227 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  5 03:44:30 ait sshd[319965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.132.200
description:
2025-02-05 03:44:58 dovecot_login authenticator failed for ([157.122.132.200]) [157.122.132.200]:36401: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 03:45:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.53.229.242
description:
[2025-02-05 03:45:05 +0100] info [webmaild] 191.53.229.242 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Feb  5 03:45:08 ait sshd[320218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.151.188.228
description:
[2025-02-05 03:45:16 +0100] info [webmaild] 89.151.188.228 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.225.139
description:
[2025-02-05 03:45:53 +0100] info [webmaild] 179.6.225.139 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
description:
Feb  5 03:45:05 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
description:
2025-02-05 03:45:07 dovecot_login authenticator failed for ([94.207.226.113]) [94.207.226.113]:46603: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Feb  5 03:45:08 ait sshd[320218]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Feb  5 03:45:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
description:
Feb  5 03:46:11 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  5 03:46:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  5 03:46:22 ait sshd[320759]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-05 03:46:24 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:54705: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-02-05 03:46:11 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:49440: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.103.38
description:
Feb  5 03:46:16 ait sshd[320616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.103.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-02-05 03:46:23 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:60874: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-02-05 03:46:27 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:54781: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Feb  5 03:46:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-02-05 03:46:01 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:33754: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Feb  5 03:46:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.202.159.233
description:
2025-02-05 03:46:09 dovecot_plain authenticator failed for ec2-52-202-159-233.compute-1.amazonaws.com [52.202.159.233]:48912: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
description:
2025-02-05 03:46:09 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:54846: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.103.38
description:
Feb  5 03:46:16 ait sshd[320616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.103.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Feb  5 03:46:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-02-05 03:46:12 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:57241: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
description:
Feb  5 03:46:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 03:46:22 ait sshd[320759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
description:
2025-02-05 03:46:25 dovecot_plain authenticator failed for syn-047-037-177-099.res.spectrum.com [47.37.177.99]:37025: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
description:
2025-02-05 03:46:34 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:51738: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.202.159.233
description:
Feb  5 03:46:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.202.159.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Feb  5 03:46:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  5 03:46:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-05 03:46:35 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:35538: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
description:
2025-02-05 03:46:13 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:53818: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
description:
Feb  5 03:46:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
description:
Feb  5 03:46:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  5 03:47:48 ait sshd[321097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  5 03:47:48 ait sshd[321097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  5 03:47:49 ait sshd[321100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.161.157.253
description:
[2025-02-05 03:47:17 +0100] info [webmaild] 200.161.157.253 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
description:
2025-02-05 03:47:42 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:44624: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Feb  5 03:47:54 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  5 03:47:32 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-05 03:47:34 dovecot_plain authenticator failed for ([45.168.168.78]) [45.168.168.78]:52040: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
description:
Feb  5 03:47:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  5 03:47:49 ait sshd[321100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.57.232.120
description:
[2025-02-05 03:47:48 +0100] info [webmaild] 95.57.232.120 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-02-05 03:47:56 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:40758: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Feb  5 03:48:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-02-05 03:48:06 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:53630: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.245.148.7
description:
[2025-02-05 03:48:06 +0100] info [webmaild] 177.245.148.7 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  5 03:48:14 ait sshd[321156]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  5 03:48:14 ait sshd[321156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.249.81.220
description:
[2025-02-05 03:48:29 +0100] info [webmaild] 167.249.81.220 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.248.192.204
description:
Feb  5 03:49:57 ait sshd[321768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.248.192.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.248.192.204
description:
Feb  5 03:49:57 ait sshd[321768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.248.192.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Feb  5 03:49:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-02-05 03:49:50 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:33363: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 03:49:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.49.222
description:
Feb  5 03:49:29 ait sshd[321688]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.49.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.49.222
description:
Feb  5 03:49:29 ait sshd[321688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.49.222


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.255.252.44
description:
Feb  5 03:50:03 ait sshd[321796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.255.252.44


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
description:
2025-02-05 03:50:25 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:35035: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Feb  5 03:50:31 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
description:
Feb  5 03:50:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-02-05 03:50:33 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:54349: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
description:
Feb  5 03:50:55 ait sshd[322307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.255.252.44
description:
Feb  5 03:50:03 ait sshd[321796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.255.252.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.245.198
description:
2025-02-05 03:50:20 dovecot_plain authenticator failed for ([114.241.245.198]) [114.241.245.198]:58475: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.170.81
description:
Feb  5 03:50:32 ait sshd[322253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.170.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.123.158
description:
[2025-02-05 03:50:35 +0100] info [webmaild] 186.68.123.158 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
description:
Feb  5 03:50:55 ait sshd[322307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.245.198
description:
Feb  5 03:50:18 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.245.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.196.163.164
description:
[2025-02-05 03:50:17 +0100] info [webmaild] 217.196.163.164 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.170.81
description:
Feb  5 03:50:32 ait sshd[322253]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.170.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
description:
Feb  5 03:50:33 ait sshd[322256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
description:
Feb  5 03:50:33 ait sshd[322256]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.174.245
description:
[2025-02-05 03:50:39 +0100] info [webmaild] 37.237.174.245 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-05 03:50:41 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:60326: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 139.5.132.246
description:
[2025-02-05 03:51:15 +0100] info [webmaild] 139.5.132.246 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Feb  5 03:51:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
description:
Feb  5 03:51:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
description:
Feb  5 03:51:42 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
description:
2025-02-05 03:51:43 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:48950: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
description:
2025-02-05 03:51:44 dovecot_plain authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:2123: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Feb  5 03:51:44 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
description:
2025-02-05 03:51:35 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:46499: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-05 03:51:35 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:62342: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
description:
Feb  5 03:51:41 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-02-05 03:51:46 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:45030: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-05 03:52:03 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:58488: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
description:
Feb  5 03:52:45 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  5 03:52:47 ait sshd[322936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  5 03:52:47 ait sshd[322936]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
description:
Feb  5 03:52:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
description:
Feb  5 03:52:19 ait sshd[322761]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.216.173
description:
[2025-02-05 03:52:41 +0100] info [webmaild] 45.183.216.173 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.110.99
description:
47.128.110.99 - - [05/Feb/2025:03:52:37 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20577958 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/52331d?panel=validator" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.99


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
description:
2025-02-05 03:52:47 dovecot_plain authenticator failed for ([111.39.206.23]) [111.39.206.23]:57689: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  5 03:52:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
description:
2025-02-05 03:52:09 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:44072: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  5 03:52:19 ait sshd[322761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Feb  5 03:53:18 ait sshd[322985]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
description:
Feb  5 03:53:51 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-02-05 03:53:55 dovecot_plain authenticator failed for ([50.224.22.135]) [50.224.22.135]:47603: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Feb  5 03:53:53 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
description:
2025-02-05 03:53:53 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:54518: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
description:
Feb  5 03:53:55 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.169.1.242
description:
[2025-02-05 03:53:12 +0100] info [webmaild] 200.169.1.242 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.64.18.217
description:
[2025-02-05 03:53:15 +0100] info [webmaild] 181.64.18.217 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  5 03:53:18 ait sshd[322985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.27.7.205
description:
[2025-02-05 03:53:51 +0100] info [webmaild] 95.27.7.205 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
description:
2025-02-05 03:53:57 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:58572: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.191.79
description:
Feb  5 03:54:39 ait sshd[323544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.191.79  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-02-05 03:54:50 dovecot_login authenticator failed for ([193.252.152.214]) [193.252.152.214]:34110: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
description:
2025-02-05 03:54:12 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:54451: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
description:
2025-02-05 03:54:15 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:52281: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 20.127.210.207
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:03-54.20.127.210.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-05 03:54:23 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:55099: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  5 03:54:45 ait sshd[323568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  5 03:54:45 ait sshd[323568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Feb  5 03:54:48 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
description:
Feb  5 03:54:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
description:
Feb  5 03:54:10 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  5 03:54:21 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-02-05 03:54:09 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:58570: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.100.186.71
description:
Feb  5 03:54:22 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.100.186.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.100.186.71
description:
2025-02-05 03:54:24 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:60412: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Feb  5 03:54:07 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Feb  5 03:55:09 ait sshd[323758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 03:55:26 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Feb  5 03:55:25 ait sshd[323784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.217.88.163
description:
[2025-02-05 03:55:44 +0100] info [webmaild] 179.217.88.163 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-02-05 03:55:01 dovecot_login authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:57488: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Feb  5 03:55:09 ait sshd[323758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.153.209
description:
[2025-02-05 03:55:13 +0100] info [webmaild] 186.249.153.209 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Feb  5 03:55:25 ait sshd[323784]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Feb  5 03:54:59 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.194.148.132
description:
Feb  5 03:56:23 ait sshd[324110]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.194.148.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Feb  5 03:56:43 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
description:
Feb  5 03:56:57 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 205.164.159.140
description:
[2025-02-05 03:56:01 +0100] info [webmaild] 205.164.159.140 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Feb  5 03:56:20 ait sshd[324104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.41.120
description:
Feb  5 03:56:56 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.41.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.41.120
description:
2025-02-05 03:56:58 dovecot_plain authenticator failed for ([185.181.41.120]) [185.181.41.120]:34435: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.194.148.132
description:
Feb  5 03:56:23 ait sshd[324110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.194.148.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.36.41
description:
[2025-02-05 03:56:36 +0100] info [webmaild] 45.187.36.41 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  5 03:56:37 ait sshd[324262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  5 03:56:16 ait sshd[324089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
description:
Feb  5 03:56:38 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Feb  5 03:56:20 ait sshd[324104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  5 03:56:37 ait sshd[324262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-02-05 03:56:40 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:39534: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-02-05 03:56:45 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:43400: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Feb  5 03:57:40 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.176.10.139
description:
[2025-02-05 03:57:54 +0100] info [webmaild] 78.176.10.139 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.71.195
description:
Feb  5 03:57:32 ait sshd[324484]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.194.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.194.71.195
description:
Feb  5 03:57:32 ait sshd[324484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.194.71.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-02-05 03:57:42 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:37408: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
description:
2025-02-05 03:56:59 dovecot_plain authenticator failed for ([103.132.199.18]) [103.132.199.18]:46774: 535 Incorrect authentication data (set_id=obiri)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-57.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.248.192.204
description:
Feb  5 03:58:21 ait sshd[324561]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.248.192.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.184.10
description:
Feb  5 03:58:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.184.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.74
description:
Feb  5 03:58:29 ait sshd[324601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.74


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.56.33
description:
[2025-02-05 03:58:40 +0100] info [webmaild] 138.36.56.33 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
description:
Feb  5 03:58:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
description:
2025-02-05 03:58:11 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:38796: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.184.10
description:
2025-02-05 03:58:29 dovecot_plain authenticator failed for ([59.41.184.10]) [59.41.184.10]:41491: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Feb  5 03:58:02 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-02-05 03:58:04 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:42991: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.248.192.204
description:
Feb  5 03:58:21 ait sshd[324561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.248.192.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.135.239.239
description:
[2025-02-05 03:58:25 +0100] info [webmaild] 31.135.239.239 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.30.15.90
description:
[2025-02-05 03:59:14 +0100] info [webmaild] 193.30.15.90 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.215.126.22
description:
Feb  5 04:00:01 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.215.126.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
description:
2025-02-05 04:00:21 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:51463: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
description:
Feb  5 04:00:30 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Feb  5 04:00:01 ait sshd[325208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-02-05 04:00:06 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:35694: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Feb  5 04:00:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-02-05 04:00:15 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:58814: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.22.0.76
description:
Feb  5 04:00:27 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.22.0.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.215.126.22
description:
2025-02-05 04:00:03 dovecot_plain authenticator failed for ([60.215.126.22]) [60.215.126.22]:33827: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
description:
2025-02-05 04:00:27 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:55785: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.22.0.76
description:
2025-02-05 04:00:29 dovecot_plain authenticator failed for ([111.22.0.76]) [111.22.0.76]:52852: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
description:
2025-02-05 04:00:32 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:58276: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Feb  5 04:00:01 ait sshd[325208]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Feb  5 04:00:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
description:
Feb  5 04:00:09 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
description:
2025-02-05 04:00:11 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:49216: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
description:
Feb  5 04:00:19 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
description:
Feb  5 04:00:25 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.205.94
description:
[2025-02-05 04:00:32 +0100] info [webmaild] 27.147.205.94 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-02-05 04:01:25 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:37172: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.179.38
description:
[2025-02-05 04:01:33 +0100] info [webmaild] 181.116.179.38 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 04:01:41 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:58182: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  5 04:01:47 ait sshd[326226]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.82.211.83
description:
[2025-02-05 04:01:01 +0100] info [webmaild] 41.82.211.83 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
description:
Feb  5 04:01:23 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 04:01:39 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  5 04:01:47 ait sshd[326226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  5 04:02:05 ait sshd[326283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
description:
2025-02-05 04:02:35 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:44410: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
description:
Feb  5 04:02:04 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
description:
2025-02-05 04:02:06 dovecot_plain authenticator failed for ([122.227.77.118]) [122.227.77.118]:56322: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Feb  5 04:02:13 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.236.214
description:
Feb  5 04:02:35 ait sshd[326656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.236.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-02-05 04:02:15 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:43727: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
description:
Feb  5 04:02:33 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
description:
Feb  5 04:02:05 ait sshd[326283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.179.9.144
description:
[2025-02-05 04:02:07 +0100] info [webmaild] 196.179.9.144 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Feb  5 04:02:15 ait auth[161991]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-02-05 04:02:17 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:59040: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.236.214
description:
Feb  5 04:02:35 ait sshd[326656]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.236.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.210.107.22
description:
Feb  5 04:03:58 ait sshd[326986]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.210.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
description:
Feb  5 04:03:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.157
description:
Feb  5 04:03:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  5 04:03:15 ait sshd[326767]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
description:
2025-02-05 04:03:16 dovecot_plain authenticator failed for ([170.233.29.157]) [170.233.29.157]:39913: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
description:
Feb  5 04:03:41 ait sshd[326959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Feb  5 04:03:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.54.243.67
description:
[2025-02-05 04:03:12 +0100] info [webmaild] 186.54.243.67 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.244
description:
2025-02-05 04:03:22 dovecot_plain authenticator failed for ([123.214.65.244]) [123.214.65.244]:56930: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.162.76
description:
[2025-02-05 04:03:44 +0100] info [webmaild] 177.125.162.76 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-02-05 04:03:53 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:23963: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
description:
2025-02-05 04:03:12 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:26262: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  5 04:03:15 ait sshd[326767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
description:
Feb  5 04:03:26 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.210.107.22
description:
Feb  5 04:03:58 ait sshd[326986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.107.22


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
description:
Feb  5 04:03:41 ait sshd[326959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.244
description:
Feb  5 04:03:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
description:
2025-02-05 04:03:28 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:42773: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.107.22
description:
Feb  5 04:04:00 ait sshd[326986]: Failed password for invalid user abc from 51.210.107.22 port 57856 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
description:
2025-02-05 04:04:15 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:59570: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-02-05 04:04:45 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:38530: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
description:
2025-02-05 04:04:01 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:46373: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.206.201.196
description:
[2025-02-05 04:04:21 +0100] info [webmaild] 190.206.201.196 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 04:04:05 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:54074: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Feb  5 04:04:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  5 04:04:26 ait sshd[327193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-02-05 04:04:27 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:32564: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-02-05 04:04:42 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:59276: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Feb  5 04:04:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.142.105.18
description:
Feb  5 04:03:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.142.105.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-02-05 04:04:05 dovecot_plain authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:56648: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Feb  5 04:04:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.237.146
description:
[2025-02-05 04:04:55 +0100] info [webmaild] 190.97.237.146 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
description:
Feb  5 04:04:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  5 04:04:26 ait sshd[327193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Feb  5 04:04:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 04:04:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 04:04:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.105.104.168
description:
Feb  5 04:05:43 ait sshd[327826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.104.168


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 04:05:34 ait sshd[327694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Feb  5 04:05:36 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.70.16
description:
Feb  5 04:05:53 ait sshd[327832]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.70.16 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  5 04:05:24 ait sshd[327664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Feb  5 04:05:27 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-02-05 04:05:52 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:52148: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
description:
Feb  5 04:05:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
description:
2025-02-05 04:05:05 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:56908: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Feb  5 04:05:50 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
description:
Feb  5 04:05:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
description:
2025-02-05 04:05:43 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:47696: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.105.104.168
description:
Feb  5 04:05:43 ait sshd[327826]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.105.104.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.70.16
description:
Feb  5 04:05:53 ait sshd[327832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.70.16  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
description:
Feb  5 04:05:24 ait sshd[327664]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-02-05 04:05:29 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:52703: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-02-05 04:05:38 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:51269: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.181.229.220
description:
[2025-02-05 04:05:58 +0100] info [webmaild] 187.181.229.220 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.221.48
description:
Feb  5 04:06:11 ait sshd[327950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.221.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.221.48
description:
Feb  5 04:06:11 ait sshd[327950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.221.48


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
description:
Feb  5 04:06:50 ait sshd[328184]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
description:
Feb  5 04:06:50 ait sshd[328184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.21.155.236
description:
[2025-02-05 04:06:55 +0100] info [webmaild] 201.21.155.236 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.91.136
description:
[2025-02-05 04:06:29 +0100] info [webmaild] 45.168.91.136 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 74.116.41.42
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-06.74.116.41.42


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.74
description:
Feb  5 04:06:04 ait sshd[327944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.74


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.71.195
description:
Feb  5 04:06:42 ait sshd[328145]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.194.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.194.71.195
description:
Feb  5 04:06:42 ait sshd[328145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.194.71.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
description:
2025-02-05 04:07:27 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:40422: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.33.74.81
description:
Feb  5 04:07:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.33.74.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Feb  5 04:07:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-02-05 04:07:55 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:37212: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Feb  5 04:07:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
description:
2025-02-05 04:07:44 dovecot_plain authenticator failed for ([148.102.73.4]) [148.102.76.10]:42848: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  5 04:07:02 ait sshd[328246]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  5 04:07:02 ait sshd[328246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.103.231
description:
Feb  5 04:07:16 ait sshd[328258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.103.231


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  5 04:07:36 ait sshd[328327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
description:
Feb  5 04:07:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Feb  5 04:07:09 ait sshd[328253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.212.162.67
description:
[2025-02-05 04:07:32 +0100] info [webmaild] 177.212.162.67 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  5 04:07:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-05 04:07:45 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:47663: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.103.231
description:
Feb  5 04:07:16 ait sshd[328258]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.103.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
description:
Feb  5 04:07:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  5 04:07:36 ait sshd[328327]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.33.74.81
description:
2025-02-05 04:07:39 dovecot_plain authenticator failed for (hospitalperpetuosocorro.static.gvt.net.br) [191.33.74.81]:41323: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.165.224
description:
[2025-02-05 04:08:41 +0100] info [webmaild] 179.106.165.224 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.70.16
description:
Feb  5 04:07:59 ait sshd[328465]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.70.16 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.70.16
description:
Feb  5 04:07:59 ait sshd[328465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.70.16  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-02-05 04:08:01 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:52182: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 209.182.196.19
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:04-08.209.182.196.19


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  5 04:09:47 ait sshd[329079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
description:
Feb  5 04:09:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.230.238
description:
[2025-02-05 04:09:13 +0100] info [webmaild] 38.156.230.238 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
description:
Feb  5 04:09:42 ait sshd[328952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
description:
Feb  5 04:09:42 ait sshd[328952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.202
description:
[2025-02-05 04:09:33 +0100] info [webmaild] 84.54.70.202 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
description:
2025-02-05 04:09:46 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:44870: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  5 04:09:47 ait sshd[329079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.81
description:
Feb  5 04:09:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  5 04:09:24 ait sshd[328779]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  5 04:09:24 ait sshd[328779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
description:
2025-02-05 04:10:01 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:34060: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.81.117.20
description:
Feb  5 04:10:17 ait sshd[329265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.81.117.20


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  5 04:10:44 ait sshd[329454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  5 04:10:44 ait sshd[329454]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.242.226.133
description:
[2025-02-05 04:10:09 +0100] info [webmaild] 179.242.226.133 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 04:11:09 ait sshd[329555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 04:11:09 ait sshd[329555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.242.54.40
description:
[2025-02-05 04:11:50 +0100] info [webmaild] 91.242.54.40 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-11.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Feb  5 04:11:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.64.182
description:
[2025-02-05 04:11:20 +0100] info [webmaild] 170.244.64.182 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.79.83.28
description:
2025-02-05 04:11:30 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:39394: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  5 04:11:32 ait sshd[329747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 04:11:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-02-05 04:11:18 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:40449: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.79.83.28
description:
Feb  5 04:11:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.79.83.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  5 04:11:32 ait sshd[329747]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 04:12:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Feb  5 04:12:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Feb  5 04:12:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
description:
Feb  5 04:12:57 ait sshd[330143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-02-05 04:12:59 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:40548: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.103.38
description:
Feb  5 04:12:26 ait sshd[329940]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.174.103.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.174.103.38
description:
Feb  5 04:12:26 ait sshd[329940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.174.103.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Feb  5 04:12:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-02-05 04:12:39 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:43224: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.237.192
description:
[2025-02-05 04:12:45 +0100] info [webmaild] 170.246.237.192 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.13.41.84
description:
[2025-02-05 04:12:08 +0100] info [webmaild] 181.13.41.84 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-02-05 04:12:51 dovecot_login authenticator failed for (marvitel.static.gvt.net.br) [179.185.1.177]:43261: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
description:
Feb  5 04:12:57 ait sshd[330143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.136.97.11
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:04-12.193.136.97.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.15.101.6
description:
Feb  5 04:13:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.15.101.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.236.214
description:
Feb  5 04:13:24 ait sshd[330256]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.236.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.245.186.231
description:
[2025-02-05 04:13:54 +0100] info [webmaild] 189.245.186.231 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
description:
Feb  5 04:13:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  5 04:13:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
description:
Feb  5 04:13:35 ait sshd[330316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-05 04:13:14 dovecot_plain authenticator failed for ([186.239.41.74]) [186.239.41.74]:44439: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
description:
Feb  5 04:13:35 ait sshd[330316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.101.6
description:
2025-02-05 04:13:25 dovecot_plain authenticator failed for ([190.15.101.6]) [190.15.101.6]:59946: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.236.214
description:
Feb  5 04:13:24 ait sshd[330256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.236.214


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.74
description:
Feb  5 04:13:36 ait sshd[330323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.74  user=operator


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
description:
2025-02-05 04:13:11 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:52292: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-05 04:14:41 dovecot_login authenticator failed for ([186.200.8.115]) [186.200.249.162]:35712: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.103.231
description:
Feb  5 04:14:42 ait sshd[330799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.103.231


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-02-05 04:14:48 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:39801: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
description:
Feb  5 04:14:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-02-05 04:14:24 dovecot_login authenticator failed for (85.105.241.188.static.ttnet.com.tr) [85.105.241.188]:47884: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Feb  5 04:14:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Feb  5 04:14:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Feb  5 04:14:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
description:
Feb  5 04:14:13 ait sshd[330608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Feb  5 04:14:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
description:
Feb  5 04:14:13 ait sshd[330608]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.136.7
description:
[2025-02-05 04:14:25 +0100] info [webmaild] 181.46.136.7 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  5 04:14:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.103.231
description:
Feb  5 04:14:42 ait sshd[330799]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.103.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-05 04:14:36 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:57046: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  5 04:14:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-02-05 04:14:40 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:57365: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  5 04:14:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-02-05 04:14:04 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (pologranic) [89.153.62.100]:36626: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-02-05 04:14:05 dovecot_login authenticator failed for ([45.201.140.227]) [45.201.140.227]:62372: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.181.15.99
description:
[2025-02-05 04:14:48 +0100] info [webmaild] 168.181.15.99 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-02-05 04:14:53 dovecot_login authenticator failed for (marvitel.static.gvt.net.br) [179.185.1.177]:52350: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  5 04:15:14 ait sshd[331185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
description:
2025-02-05 04:15:24 dovecot_login authenticator failed for ([211.243.43.30]) [211.243.43.30]:46638: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
description:
2025-02-05 04:15:40 dovecot_login authenticator failed for ([106.246.6.133]) [106.246.6.133]:48730: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Feb  5 04:15:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
description:
Feb  5 04:15:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.169.144
description:
Feb  5 04:15:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.169.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.169.144
description:
2025-02-05 04:15:02 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [117.242.169.144]:47414: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-02-05 04:15:01 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:41690: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  5 04:15:14 ait sshd[331185]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-02-05 04:15:18 dovecot_login authenticator failed for ([211.52.131.183]) [211.52.131.183]:54775: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
description:
Feb  5 04:15:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.140.54
description:
[2025-02-05 04:15:24 +0100] info [webmaild] 179.125.140.54 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-02-05 04:16:39 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:35782: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Feb  5 04:16:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.54.42
description:
Feb  5 04:16:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.54.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.9.2.192
description:
[2025-02-05 04:16:35 +0100] info [webmaild] 177.9.2.192 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.28.254
description:
47.128.28.254 - - [05/Feb/2025:04:16:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24667487 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?filter_course-language=120%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.28.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.54.42
description:
2025-02-05 04:16:25 dovecot_plain authenticator failed for (201-91-54-42.customer.tdatabrasil.net.br) [201.91.54.42]:45794: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.115.116
description:
47.128.115.116 - - [05/Feb/2025:04:16:29 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234363 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?filter_course-language=120%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.115.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
description:
Feb  5 04:17:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  5 04:17:59 ait sshd[331956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  5 04:17:03 ait sshd[331732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.28.211.3
description:
[2025-02-05 04:17:30 +0100] info [webmaild] 181.28.211.3 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
description:
Feb  5 04:17:59 ait sshd[331956]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.86.50.39
description:
Feb  5 04:17:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.86.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.86.50.39
description:
2025-02-05 04:17:19 dovecot_login authenticator failed for syn-174-086-050-039.res.spectrum.com [174.86.50.39]:49449: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Feb  5 04:17:05 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
description:
2025-02-05 04:17:57 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.151.150]:48201: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Feb  5 04:17:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  5 04:17:57 ait sshd[331954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.193.124.213
description:
[2025-02-05 04:17:07 +0100] info [webmaild] 41.193.124.213 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-02-05 04:17:07 dovecot_login authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:58966: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  5 04:17:57 ait sshd[331954]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.109.10.69
description:
Feb  5 04:18:01 ait sshd[331956]: Failed password for invalid user ldap from 208.109.10.69 port 37816 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.105.200.93
description:
[2025-02-05 04:18:04 +0100] info [webmaild] 176.105.200.93 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  5 04:18:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-02-05 04:18:25 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:58960: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
description:
2025-02-05 04:18:43 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:52185: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-05 04:18:09 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:53002: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Feb  5 04:18:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.156
description:
Feb  5 04:18:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  5 04:18:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
description:
Feb  5 04:18:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-05 04:18:55 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:35264: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-02-05 04:18:01 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:47920: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-02-05 04:18:09 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:56758: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-02-05 04:18:21 dovecot_login authenticator failed for ([59.97.139.38]) [59.97.139.38]:51216: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.115.205.253
description:
Feb  5 04:18:32 ait sshd[332044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.115.205.253


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  5 04:18:31 ait sshd[332042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.156
description:
2025-02-05 04:18:32 dovecot_login authenticator failed for ([172.109.253.156]) [172.109.253.156]:33254: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
description:
2025-02-05 04:18:49 dovecot_login authenticator failed for ([183.123.27.87]) [183.123.27.87]:58897: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.205.253
description:
Feb  5 04:18:32 ait sshd[332044]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.115.205.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-05 04:18:34 dovecot_login authenticator failed for ([43.143.231.208]) [43.143.231.208]:35922: 535 Incorrect authentication data (set_id=ads39a22282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Feb  5 04:18:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-05 04:18:10 dovecot_login authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:58506: 535 Incorrect authentication data (set_id=ads39a22282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Feb  5 04:18:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
description:
Feb  5 04:18:31 ait sshd[332042]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
description:
Feb  5 04:18:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  5 04:18:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  5 04:18:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-02-05 04:20:34 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:53426: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.166.73
description:
Feb  5 04:20:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.166.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  5 04:20:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.203.17
description:
[2025-02-05 04:20:48 +0100] info [webmaild] 177.73.203.17 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-05 04:20:11 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.157.111]:45436: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Feb  5 04:20:17 ait sshd[333156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Feb  5 04:20:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
description:
Feb  5 04:20:43 ait sshd[333508]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  5 04:20:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-05 04:20:25 dovecot_login authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:51200: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Feb  5 04:20:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
description:
Feb  5 04:20:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-02-05 04:20:55 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:57535: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  5 04:21:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
description:
Feb  5 04:20:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
description:
2025-02-05 04:20:18 dovecot_login authenticator failed for (187-9-3-190.customer.tdatabrasil.net.br) [187.9.3.190]:33752: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Feb  5 04:20:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-02-05 04:20:37 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:47382: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
description:
2025-02-05 04:20:49 dovecot_plain authenticator failed for ([117.158.166.73]) [117.158.166.73]:28450: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-02-05 04:20:30 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:42133: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-02-05 04:20:37 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:63706: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-05 04:20:48 dovecot_plain authenticator failed for ([179.181.133.153]) [179.181.133.153]:47381: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  5 04:20:10 ait sshd[333143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.42.129.132
description:
[2025-02-05 04:20:13 +0100] info [webmaild] 176.42.129.132 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Feb  5 04:20:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Feb  5 04:20:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
description:
Feb  5 04:20:43 ait sshd[333508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-02-05 04:20:44 dovecot_login authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:34297: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
description:
Feb  5 04:20:10 ait sshd[333143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  5 04:20:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
description:
Feb  5 04:21:42 ait sshd[333808]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-02-05 04:21:22 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:50650: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
description:
2025-02-05 04:21:55 dovecot_login authenticator failed for ([124.115.229.202]) [124.115.229.202]:57186: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.21.142.240
description:
2025-02-05 04:21:10 dovecot_plain authenticator failed for ([38.21.142.240]) [38.21.142.240]:43964: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-02-05 04:21:36 dovecot_login authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:38776: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
description:
Feb  5 04:21:50 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
description:
2025-02-05 04:21:51 dovecot_login authenticator failed for ([85.130.181.81]) [85.130.181.81]:63735: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
description:
Feb  5 04:22:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 04:21:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
description:
Feb  5 04:21:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.159.139.135
description:
2025-02-05 04:21:41 dovecot_plain authenticator failed for (135.139-159-67.res.dyn.surewest.net) [67.159.139.135]:40016: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  5 04:21:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-05 04:21:46 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:34927: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-05 04:21:05 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:43532: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Feb  5 04:21:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.68.134
description:
[2025-02-05 04:21:52 +0100] info [webmaild] 182.48.68.134 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
description:
2025-02-05 04:21:59 dovecot_plain authenticator failed for ([197.156.97.198]) [197.156.97.198]:55514: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
description:
Feb  5 04:21:39 ait sshd[333802]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
description:
Feb  5 04:21:39 ait sshd[333802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
description:
Feb  5 04:21:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.180.218
description:
2025-02-05 04:22:01 dovecot_login authenticator failed for ([113.108.180.218]) [113.108.180.218]:39949: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.69.31.50
description:
Feb  5 04:21:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.69.31.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Feb  5 04:21:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Feb  5 04:21:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
description:
Feb  5 04:21:42 ait sshd[333808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.97.198
description:
Feb  5 04:21:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.97.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.180.218
description:
Feb  5 04:21:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.180.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-02-05 04:22:04 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:64574: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-02-05 04:21:18 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:51566: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.159.139.135
description:
Feb  5 04:21:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.159.139.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
description:
2025-02-05 04:21:52 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:55017: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Feb  5 04:22:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
description:
2025-02-05 04:22:04 dovecot_login authenticator failed for ([122.228.225.21]) [122.228.225.21]:47279: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.31.50
description:
2025-02-05 04:21:06 dovecot_plain authenticator failed for ([109.69.31.50]) [109.69.31.50]:53824: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.21.142.240
description:
Feb  5 04:21:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.21.142.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
description:
Feb  5 04:22:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Feb  5 04:22:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
description:
Feb  5 04:22:33 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-05 04:22:44 dovecot_login authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:38082: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Feb  5 04:22:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.24.215.70
description:
Feb  5 04:22:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.24.215.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-02-05 04:22:09 dovecot_login authenticator failed for ([120.224.15.67]) [120.224.15.67]:5640: 535 Incorrect authentication data (set_id=ads23b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-02-05 04:22:16 dovecot_login authenticator failed for ([221.161.16.240]) [221.161.16.240]:54099: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
description:
2025-02-05 04:22:35 dovecot_login authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:49136: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.173.106.95
description:
Feb  5 04:22:58 ait sshd[334143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.173.106.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.129.199.136
description:
[2025-02-05 04:22:21 +0100] info [webmaild] 94.129.199.136 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
description:
2025-02-05 04:22:27 dovecot_login authenticator failed for ([183.107.76.127]) [183.107.76.127]:56211: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Feb  5 04:22:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
description:
2025-02-05 04:22:57 dovecot_login authenticator failed for (static-11.80.156.182-tataidc.co.in) [182.156.80.11]:44886: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 04:22:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.108.70.38
description:
2025-02-05 04:22:11 dovecot_plain authenticator failed for ([218.108.70.38]) [218.108.70.38]:56536: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.213.85
description:
2025-02-05 04:23:03 dovecot_plain authenticator failed for ([183.237.213.85]) [183.237.213.85]:58406: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.173.106.95
description:
Feb  5 04:22:58 ait sshd[334143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.173.106.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.108.70.38
description:
Feb  5 04:22:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.108.70.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.95.4
description:
[2025-02-05 04:22:50 +0100] info [webmaild] 190.115.95.4 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
description:
2025-02-05 04:22:10 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:54422: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.213.85
description:
Feb  5 04:23:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.213.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-05 04:23:14 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:56814: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Feb  5 04:23:50 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Feb  5 04:23:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-02-05 04:23:59 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:45629: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  5 04:23:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.121.153.218
description:
[2025-02-05 04:23:28 +0100] info [webmaild] 196.121.153.218 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-05 04:23:48 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:9584: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-02-05 04:23:52 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:42002: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.58.173
description:
Feb  5 04:24:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.58.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  5 04:23:52 ait sshd[334422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  5 04:23:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
description:
Feb  5 04:23:52 ait sshd[334422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Feb  5 04:24:29 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
description:
2025-02-05 04:24:46 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:42064: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.140.104
description:
[2025-02-05 04:24:23 +0100] info [webmaild] 186.249.140.104 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
description:
Feb  5 04:24:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.214.92.142
description:
2025-02-05 04:24:45 dovecot_login authenticator failed for (142.92.214.139.adsl-pool.jlccptt.net.cn) [139.214.92.142]:49342: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  5 04:24:53 ait sshd[334852]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  5 04:24:53 ait sshd[334852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
description:
2025-02-05 04:24:55 dovecot_plain authenticator failed for ([61.189.61.162]) [61.189.61.162]:47808: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.58.173
description:
2025-02-05 04:24:06 dovecot_plain authenticator failed for ([192.199.58.173]) [192.199.58.173]:46361: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.214.92.142
description:
Feb  5 04:24:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.214.92.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.189.61.162
description:
Feb  5 04:24:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.189.61.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.90.8.185
description:
[2025-02-05 04:24:55 +0100] info [webmaild] 41.90.8.185 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-02-05 04:24:31 dovecot_login authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:51308: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
description:
Feb  5 04:25:32 ait sshd[335350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Feb  5 04:25:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Feb  5 04:25:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
description:
2025-02-05 04:25:08 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.156.14]:42839: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
description:
Feb  5 04:25:32 ait sshd[335350]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-02-05 04:25:42 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:50462: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.208.245
description:
2025-02-05 04:25:49 dovecot_login authenticator failed for (m121-202-208-245.smartone.com) [121.202.208.245]:54894: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-02-05 04:25:10 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:46382: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.114.194
description:
2025-02-05 04:25:29 dovecot_login authenticator failed for ([186.233.114.194]) [186.233.114.194]:39662: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.167.229.232
description:
[2025-02-05 04:25:25 +0100] info [webmaild] 103.167.229.232 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.114.194
description:
Feb  5 04:25:27 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.114.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.26.230
description:
Feb  5 04:25:33 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.26.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.26.230
description:
2025-02-05 04:25:35 dovecot_login authenticator failed for 111-70-26-230.emome-ip.hinet.net [111.70.26.230]:35564: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
description:
Feb  5 04:25:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  5 04:26:03 ait sshd[335442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  5 04:26:03 ait sshd[335442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.208.245
description:
Feb  5 04:25:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.208.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.151.58
description:
[2025-02-05 04:26:00 +0100] info [webmaild] 45.163.151.58 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.171.21.192
description:
Feb  5 04:26:06 ait sshd[335442]: Failed password for invalid user cynthia from 203.171.21.192 port 58664 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-02-05 04:26:08 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:47316: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.44.76.103
description:
Feb  5 04:26:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.44.76.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-02-05 04:26:25 dovecot_login authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:56888: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-26.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
description:
Feb  5 04:26:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.103.200
description:
Feb  5 04:26:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.103.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.162.217
description:
Feb  5 04:26:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.162.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.200
description:
2025-02-05 04:26:59 dovecot_login authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:55980: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.162.217
description:
2025-02-05 04:27:00 dovecot_login authenticator failed for ([59.24.162.217]) [59.24.162.217]:60040: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  5 04:26:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
description:
2025-02-05 04:26:41 dovecot_plain authenticator failed for ([222.132.167.110]) [222.132.167.110]:40587: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
description:
Feb  5 04:27:26 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 04:27:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Feb  5 04:27:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-02-05 04:27:41 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:18697: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Feb  5 04:27:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
description:
2025-02-05 04:27:09 dovecot_login authenticator failed for ([12.189.234.28]) [12.189.234.28]:59643: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 04:27:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.127.252.203
description:
[2025-02-05 04:27:20 +0100] info [webmaild] 177.127.252.203 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
description:
2025-02-05 04:27:28 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:55906: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.215.27
description:
[2025-02-05 04:27:53 +0100] info [webmaild] 179.125.215.27 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.16.137
description:
Feb  5 04:27:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.6.16.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
description:
Feb  5 04:27:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-02-05 04:27:49 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:50180: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
description:
2025-02-05 04:27:58 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:54314: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Feb  5 04:28:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.12.174.168
description:
[2025-02-05 04:28:07 +0100] info [webmaild] 189.12.174.168 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
description:
Feb  5 04:28:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-02-05 04:28:37 dovecot_login authenticator failed for ([59.97.139.38]) [59.97.139.38]:46790: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.85.107
description:
Feb  5 04:28:41 ait sshd[336311]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.85.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.85.107
description:
Feb  5 04:28:41 ait sshd[336311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.85.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Feb  5 04:28:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.97.174.181
description:
[2025-02-05 04:28:43 +0100] info [webmaild] 177.97.174.181 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.42.85
description:
Feb  5 04:28:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.42.85 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  5 04:28:56 ait sshd[336344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
description:
2025-02-05 04:28:33 dovecot_plain authenticator failed for ([183.98.215.147]) [183.98.215.147]:12630: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  5 04:28:56 ait sshd[336344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.170.81
description:
Feb  5 04:28:39 ait sshd[336295]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.170.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.170.81
description:
Feb  5 04:28:39 ait sshd[336295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.170.81


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-02-05 04:28:47 dovecot_plain authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:50980: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-02-05 04:28:57 dovecot_login authenticator failed for ([203.124.42.85]) [203.124.42.85]:38982: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
description:
2025-02-05 04:29:42 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:46478: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
description:
Feb  5 04:29:44 ait sshd[336698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Feb  5 04:29:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-02-05 04:30:00 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:41811: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
description:
Feb  5 04:29:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
description:
Feb  5 04:29:44 ait sshd[336698]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.90.86
description:
[2025-02-05 04:29:51 +0100] info [webmaild] 38.156.90.86 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.228.168.194
description:
Feb  5 04:29:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.228.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.228.168.194
description:
2025-02-05 04:29:59 dovecot_plain authenticator failed for (mail.bntb.bm) [207.228.168.194]:35648: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.90.118
description:
Feb  5 04:30:54 ait sshd[337307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.90.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
description:
2025-02-05 04:30:12 dovecot_plain authenticator failed for ([60.2.203.254]) [60.2.203.254]:40488: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.73.242
description:
Feb  5 04:30:22 ait sshd[337264]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.37.73.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.109.154.77
description:
[2025-02-05 04:30:21 +0100] info [webmaild] 179.109.154.77 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  5 04:30:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-05 04:30:40 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:48548: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 49.156.44.230
description:
[2025-02-05 04:30:52 +0100] info [webmaild] 49.156.44.230 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.2.203.254
description:
Feb  5 04:30:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.2.203.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.37.73.242
description:
Feb  5 04:30:22 ait sshd[337264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.37.73.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.90.118
description:
Feb  5 04:30:54 ait sshd[337307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.90.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.243.64
description:
Feb  5 04:31:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.243.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Feb  5 04:32:04 ait sshd[337629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.92.132
description:
2025-02-05 04:31:07 dovecot_plain authenticator failed for ([211.228.92.132]) [211.228.92.132]:60562: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
description:
2025-02-05 04:31:08 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:53228: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-05 04:31:18 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:55060: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.113.226.222
description:
Feb  5 04:32:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.113.226.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.113.226.222
description:
2025-02-05 04:32:03 dovecot_plain authenticator failed for ([212.113.226.222]) [212.113.226.222]:56260: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.92.132
description:
Feb  5 04:31:05 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.92.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  5 04:31:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.151.113.18
description:
[2025-02-05 04:31:26 +0100] info [webmaild] 201.151.113.18 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Feb  5 04:32:04 ait sshd[337629]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.85.107
description:
Feb  5 04:32:51 ait sshd[337903]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.85.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.188
description:
2025-02-05 04:33:04 dovecot_plain authenticator failed for ([27.40.100.188]) [27.40.100.188]:55083: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 04:32:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
description:
Feb  5 04:32:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.25.51
description:
Feb  5 04:32:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.160.25.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
description:
2025-02-05 04:32:18 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:59128: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.229.90.76
description:
[2025-02-05 04:32:31 +0100] info [webmaild] 200.229.90.76 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.85.107
description:
Feb  5 04:32:51 ait sshd[337903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.85.107


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.118.126.35
description:
Feb  5 04:32:06 ait sshd[337629]: Failed password for invalid user tomcat from 175.118.126.35 port 54778 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.210.107.22
description:
Feb  5 04:32:31 ait sshd[337812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.107.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.160.25.51
description:
2025-02-05 04:32:34 dovecot_plain authenticator failed for ([217.160.25.51]) [217.160.25.51]:55843: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.1.111.102
description:
[2025-02-05 04:33:01 +0100] info [webmaild] 84.1.111.102 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.188
description:
Feb  5 04:33:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.81.117.20
description:
Feb  5 04:33:26 ait sshd[338109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.81.117.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.18.58
description:
47.128.18.58 - - [05/Feb/2025:04:33:44 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6817901 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short%2Clong&filtering=1&level=intermediate%2Cbeginner%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.18.58


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
description:
Feb  5 04:33:11 ait sshd[337955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-02-05 04:33:16 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:26465: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  5 04:33:35 ait sshd[338119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.105.104.168
description:
Feb  5 04:33:51 ait sshd[338164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.104.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
description:
2025-02-05 04:33:16 dovecot_login authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:34268: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.42.150
description:
[2025-02-05 04:33:33 +0100] info [webmaild] 170.150.42.150 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  5 04:34:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
description:
Feb  5 04:33:11 ait sshd[337955]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  5 04:33:35 ait sshd[338119]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
description:
Feb  5 04:34:01 ait sshd[338201]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
description:
Feb  5 04:34:01 ait sshd[338201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.149.228
description:
[2025-02-05 04:34:05 +0100] info [webmaild] 201.17.149.228 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Feb  5 04:33:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
description:
Feb  5 04:33:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.85.107
description:
Feb  5 04:34:13 ait sshd[338254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.85.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.85.107
description:
Feb  5 04:34:13 ait sshd[338254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.85.107  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  5 04:34:38 ait sshd[338452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-05 04:34:06 dovecot_login authenticator failed for ([128.106.196.150]) [128.106.196.150]:62063: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  5 04:34:38 ait sshd[338452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
description:
2025-02-05 04:36:02 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:47312: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.103.231
description:
Feb  5 04:36:05 ait sshd[339235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.103.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
description:
Feb  5 04:35:21 ait sshd[338885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Feb  5 04:35:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Feb  5 04:35:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-05 04:35:44 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:42804: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-02-05 04:35:49 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:54669: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-02-05 04:36:01 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:39922: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.166
description:
Feb  5 04:35:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-02-05 04:35:32 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:43628: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-05 04:35:41 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:45935: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  5 04:35:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Feb  5 04:35:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Feb  5 04:35:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.103.231
description:
Feb  5 04:36:05 ait sshd[339235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.103.231


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
description:
2025-02-05 04:35:17 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:42790: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.71.43.40
description:
Feb  5 04:35:23 ait sshd[338910]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.71.43.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.121.193.191
description:
Feb  5 04:35:29 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.121.193.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
description:
2025-02-05 04:35:34 dovecot_plain authenticator failed for ([119.207.83.89]) [119.207.83.89]:57224: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
description:
Feb  5 04:35:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.83.89
description:
Feb  5 04:35:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.83.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Feb  5 04:35:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.5.135
description:
2025-02-05 04:35:45 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:53444: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
description:
2025-02-05 04:35:45 dovecot_plain authenticator failed for ([58.18.64.54]) [58.18.64.54]:58740: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.91.221.200
description:
[2025-02-05 04:35:12 +0100] info [webmaild] 177.91.221.200 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
description:
Feb  5 04:35:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.71.43.40
description:
Feb  5 04:35:23 ait sshd[338910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.71.43.40  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
description:
Feb  5 04:36:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.5.135
description:
Feb  5 04:35:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.5.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Feb  5 04:35:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-02-05 04:35:34 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:4973: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-02-05 04:35:37 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:53023: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
description:
Feb  5 04:35:38 ait sshd[339180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  5 04:35:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
description:
Feb  5 04:35:21 ait sshd[338885]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
description:
Feb  5 04:35:38 ait sshd[339180]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.140.31
description:
[2025-02-05 04:35:42 +0100] info [webmaild] 179.125.140.31 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-02-05 04:35:47 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:50984: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  5 04:35:17 ait sshd[338807]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.121.193.191
description:
2025-02-05 04:35:31 dovecot_plain authenticator failed for syn-070-121-193-191.res.spectrum.com [70.121.193.191]:14316: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.166
description:
2025-02-05 04:35:34 dovecot_plain authenticator failed for ([218.149.228.166]) [218.149.228.166]:57313: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.51.229
description:
47.128.51.229 - - [05/Feb/2025:04:35:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23520821 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C106%2C125%2C30&filter_course-language=79&filtering=1&instructor=2%2C1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.51.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  5 04:36:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
description:
Feb  5 04:36:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
description:
2025-02-05 04:36:57 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:59055: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.166
description:
2025-02-05 04:36:58 dovecot_plain authenticator failed for ([218.149.228.166]) [218.149.228.166]:57978: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
description:
2025-02-05 04:36:59 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:55607: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Feb  5 04:36:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Feb  5 04:36:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-05 04:36:23 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:31956: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Feb  5 04:36:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-02-05 04:36:55 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:56646: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-02-05 04:36:57 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:52007: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.226.255.240
description:
Feb  5 04:36:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.226.255.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-02-05 04:36:59 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:60040: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.26.59
description:
Feb  5 04:36:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.26.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.86.50.39
description:
Feb  5 04:36:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.86.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
description:
2025-02-05 04:36:57 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:58329: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
description:
Feb  5 04:36:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-05 04:36:58 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:58581: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 04:36:59 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:39755: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
description:
Feb  5 04:37:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  5 04:36:56 ait sshd[339531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-02-05 04:36:57 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:39252: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-02-05 04:36:54 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:52168: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Feb  5 04:36:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.210.180
description:
Feb  5 04:37:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.210.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.218.230
description:
[2025-02-05 04:36:30 +0100] info [webmaild] 45.169.218.230 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Feb  5 04:36:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  5 04:36:56 ait sshd[339531]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-02-05 04:36:56 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:48876: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.58.77
description:
Feb  5 04:37:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.58.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
description:
Feb  5 04:36:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
description:
Feb  5 04:36:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Feb  5 04:36:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Feb  5 04:36:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-02-05 04:36:57 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:55148: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Feb  5 04:36:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.12
description:
Feb  5 04:37:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.12 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.103.231
description:
Feb  5 04:36:06 ait sshd[339235]: Failed password for invalid user ciro from 64.227.103.231 port 43994 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Feb  5 04:36:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  5 04:37:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-05 04:37:05 dovecot_plain authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:34600: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Feb  5 04:36:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 04:36:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Feb  5 04:36:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-02-05 04:36:57 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:40204: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Feb  5 04:36:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Feb  5 04:36:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-02-05 04:37:00 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:36809: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
description:
2025-02-05 04:37:00 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:3600: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
description:
Feb  5 04:36:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.90.89.66
description:
Feb  5 04:37:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.90.89.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
description:
2025-02-05 04:37:03 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:46796: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-02-05 04:36:15 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:58078: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-02-05 04:36:54 dovecot_plain authenticator failed for ([91.116.42.218]) [91.116.42.218]:54212: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-02-05 04:36:57 dovecot_plain authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:59544: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-02-05 04:36:58 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:59780: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-02-05 04:37:01 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:35644: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.90.89.66
description:
2025-02-05 04:37:03 dovecot_plain authenticator failed for ([66.90.89.66]) [66.90.89.66]:36058: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-02-05 04:36:55 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:60910: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-02-05 04:36:56 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:44626: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
description:
Feb  5 04:37:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
description:
Feb  5 04:36:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.250.78
description:
Feb  5 04:36:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.250.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.166
description:
Feb  5 04:36:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Feb  5 04:36:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
description:
2025-02-05 04:36:53 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:55999: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
description:
Feb  5 04:36:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.58.77
description:
2025-02-05 04:37:04 dovecot_plain authenticator failed for (77.58.221.60.adsl-pool.sx.cn) [60.221.58.77]:36695: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
description:
Feb  5 04:36:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
description:
2025-02-05 04:37:02 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:36290: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.86.50.39
description:
2025-02-05 04:36:56 dovecot_plain authenticator failed for syn-174-086-050-039.res.spectrum.com [174.86.50.39]:56707: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
description:
2025-02-05 04:36:58 dovecot_plain authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:52876: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-02-05 04:36:59 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:41765: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
description:
2025-02-05 04:37:01 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:46916: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  5 04:36:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
description:
2025-02-05 04:36:54 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:60586: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.157.195
description:
[2025-02-05 04:36:53 +0100] info [webmaild] 186.237.157.195 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.213.120.109
description:
2025-02-05 04:37:09 dovecot_plain authenticator failed for j120109.ppp.asahi-net.or.jp [61.213.120.109]:59860: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-02-05 04:37:10 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:10051: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
description:
Feb  5 04:37:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
description:
2025-02-05 04:37:17 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:55498: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
description:
2025-02-05 04:37:30 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:2192: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
description:
Feb  5 04:37:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
description:
2025-02-05 04:37:20 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:43808: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-02-05 04:37:27 dovecot_plain authenticator failed for ([125.142.39.13]) [125.142.39.13]:45847: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
description:
Feb  5 04:37:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-02-05 04:37:29 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:42978: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 64.23.250.151
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-37.64.23.250.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.9.7.174
description:
Feb  5 04:37:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.9.7.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
description:
2025-02-05 04:37:18 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:35906: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.226.255.240
description:
Feb  5 04:37:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.226.255.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-02-05 04:37:12 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:46468: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
description:
2025-02-05 04:37:13 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:52694: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.14
description:
Feb  5 04:37:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-02-05 04:37:20 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:52214: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
description:
2025-02-05 04:37:33 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:46930: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
description:
Feb  5 04:37:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
description:
2025-02-05 04:37:16 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:56652: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-05 04:37:14 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:16639: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-02-05 04:37:14 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:36130: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Feb  5 04:37:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
description:
Feb  5 04:37:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  5 04:37:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-05 04:37:10 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:49695: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  5 04:37:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.65.54.204
description:
Feb  5 04:37:16 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.65.54.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Feb  5 04:37:27 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.156.203
description:
Feb  5 04:37:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.156.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.117.186
description:
Feb  5 04:37:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.117.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-02-05 04:37:16 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:35868: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
description:
Feb  5 04:37:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.14
description:
2025-02-05 04:37:21 dovecot_plain authenticator failed for ([61.146.121.14]) [61.146.121.14]:46817: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
description:
2025-02-05 04:37:26 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:49873: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.76.106.226
description:
2025-02-05 04:37:33 dovecot_plain authenticator failed for (226.106.76.200.static.redip.topnet.com.mx) [200.76.106.226]:39010: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-02-05 04:37:10 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:26720: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  5 04:37:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
description:
Feb  5 04:37:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-02-05 04:37:22 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:45139: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
description:
2025-02-05 04:37:14 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:41073: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Feb  5 04:37:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.2
description:
2025-02-05 04:37:19 dovecot_plain authenticator failed for ([58.122.255.2]) [58.122.255.2]:41160: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
description:
2025-02-05 04:37:51 dovecot_plain authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:49192: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
description:
Feb  5 04:37:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.9.7.174
description:
2025-02-05 04:37:14 dovecot_plain authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:49936: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.2
description:
Feb  5 04:37:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-05 04:37:07 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:41331: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
description:
2025-02-05 04:37:12 dovecot_plain authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:40822: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Feb  5 04:37:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.209.141
description:
Feb  5 04:37:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.209.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Feb  5 04:37:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.32.145
description:
2025-02-05 04:37:41 dovecot_plain authenticator failed for ([117.158.40.228]) [39.164.32.145]:32795: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
description:
Feb  5 04:37:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
description:
2025-02-05 04:37:15 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:40818: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-02-05 04:37:20 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:50970: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Feb  5 04:37:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.117.186
description:
2025-02-05 04:37:09 dovecot_plain authenticator failed for ([60.219.117.186]) [60.219.117.186]:47242: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
description:
Feb  5 04:37:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.52.43
description:
Feb  5 04:37:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.52.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Feb  5 04:37:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Feb  5 04:37:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.209.141
description:
2025-02-05 04:37:20 dovecot_plain authenticator failed for 141.sub-166-169-209.myvzw.com [166.169.209.141]:28635: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
description:
2025-02-05 04:37:22 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:24245: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 04:37:22 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:46992: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Feb  5 04:37:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
description:
2025-02-05 04:37:12 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:25762: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
description:
Feb  5 04:37:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
description:
Feb  5 04:37:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
description:
2025-02-05 04:37:22 dovecot_plain authenticator failed for ([218.206.136.24]) [218.206.136.24]:54118: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
description:
2025-02-05 04:37:06 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:52512: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-02-05 04:37:40 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:49481: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.251.233.179
description:
Feb  5 04:37:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.251.233.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
description:
2025-02-05 04:37:08 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:41512: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  5 04:37:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
description:
Feb  5 04:37:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-02-05 04:37:25 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:43494: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-02-05 04:37:32 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:49331: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  5 04:37:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
description:
Feb  5 04:37:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
description:
Feb  5 04:37:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-02-05 04:37:17 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:44656: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-05 04:37:21 dovecot_plain authenticator failed for ([177.174.85.129]) [177.174.85.137]:46557: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-05 04:37:32 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:42132: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  5 04:37:05 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-02-05 04:37:10 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:47521: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  5 04:37:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
description:
2025-02-05 04:37:14 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:56086: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Feb  5 04:37:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.233.179
description:
2025-02-05 04:37:58 dovecot_plain authenticator failed for apn-87-251-233-179.static.gprs.plus.pl [87.251.233.179]:39328: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
description:
Feb  5 04:37:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.156.203
description:
2025-02-05 04:37:41 dovecot_plain authenticator failed for ([120.197.156.203]) [120.197.156.203]:37964: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.213.120.109
description:
Feb  5 04:37:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.213.120.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.65.54.204
description:
2025-02-05 04:37:18 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:54990: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
description:
Feb  5 04:37:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Feb  5 04:37:23 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Feb  5 04:37:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Feb  5 04:37:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
description:
Feb  5 04:37:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
description:
2025-02-05 04:37:24 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:56756: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.52.43
description:
2025-02-05 04:37:27 dovecot_plain authenticator failed for h-155-4-52-43.a213.priv.bahnhof.se [155.4.52.43]:40640: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.172.72
description:
Feb  5 04:37:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.172.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.76.106.226
description:
Feb  5 04:37:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.76.106.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.32.145
description:
Feb  5 04:37:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.32.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
description:
2025-02-05 04:37:06 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:40271: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
description:
2025-02-05 04:37:11 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:52882: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.150
description:
Feb  5 04:37:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-05 04:37:14 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:43007: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 04:37:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
description:
2025-02-05 04:37:21 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:20749: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.89.184
description:
[2025-02-05 04:37:51 +0100] info [webmaild] 186.224.89.184 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
description:
Feb  5 04:38:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
description:
2025-02-05 04:38:32 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:60328: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-02-05 04:38:48 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:51768: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.115.215.14
description:
[2025-02-05 04:38:58 +0100] info [webmaild] 181.115.215.14 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.84.207.171
description:
[2025-02-05 04:38:22 +0100] info [webmaild] 206.84.207.171 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
description:
Feb  5 04:38:22 ait sshd[339866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Feb  5 04:38:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-02-05 04:39:00 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:14407: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  5 04:38:22 ait sshd[339859]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
description:
Feb  5 04:38:22 ait sshd[339866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Feb  5 04:38:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 04:38:22 ait sshd[339859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  5 04:39:50 ait sshd[340304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.253.175
description:
2025-02-05 04:39:53 dovecot_plain authenticator failed for (merse) [90.188.253.175]:41152: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  5 04:39:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.253.175
description:
Feb  5 04:39:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.246.198.162
description:
[2025-02-05 04:39:35 +0100] info [webmaild] 179.246.198.162 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  5 04:39:50 ait sshd[340304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-05 04:39:08 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:47664: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 04:40:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Feb  5 04:40:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
description:
Feb  5 04:40:14 ait sshd[340736]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
description:
Feb  5 04:40:14 ait sshd[340736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  5 04:40:17 ait sshd[340768]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.32.254
description:
[2025-02-05 04:40:34 +0100] info [webmaild] 86.108.32.254 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-02-05 04:40:44 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:44416: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
description:
Feb  5 04:41:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Feb  5 04:40:24 ait sshd[340786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.118.248
description:
Feb  5 04:40:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.118.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
description:
2025-02-05 04:40:42 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:36871: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.9.146
description:
Feb  5 04:40:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.9.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.9.146
description:
2025-02-05 04:40:56 dovecot_plain authenticator failed for ([180.166.163.26]) [58.246.9.146]:34594: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-02-05 04:41:02 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:47234: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  5 04:40:17 ait sshd[340768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
description:
2025-02-05 04:40:21 dovecot_plain authenticator failed for 177-72-87-7.static.as262543.net.br (7.lifedns.com.br) [177.72.87.7]:56904: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 04:40:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.118.248
description:
2025-02-05 04:40:33 dovecot_plain authenticator failed for ([183.6.118.248]) [183.6.118.248]:39851: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
description:
Feb  5 04:40:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  5 04:40:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Feb  5 04:41:04 ait sshd[341062]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-05 04:40:37 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:25004: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
description:
Feb  5 04:40:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  5 04:40:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-05 04:40:43 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:42180: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Feb  5 04:40:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
description:
2025-02-05 04:41:02 dovecot_plain authenticator failed for ([103.172.48.197]) [103.172.48.197]:53643: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Feb  5 04:40:24 ait sshd[340786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-02-05 04:40:46 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:41733: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Feb  5 04:41:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Feb  5 04:41:04 ait sshd[341062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.150.88.29
description:
[2025-02-05 04:41:05 +0100] info [webmaild] 190.150.88.29 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-05 04:41:29 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:31046: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  5 04:41:17 ait sshd[341101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  5 04:41:17 ait sshd[341101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  5 04:41:27 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
description:
Feb  5 04:41:43 ait sshd[341268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.252.231.234
description:
[2025-02-05 04:41:44 +0100] info [webmaild] 38.252.231.234 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.122.189
description:
Feb  5 04:41:06 ait sshd[341062]: Failed password for invalid user validator from 2.57.122.189 port 35552 ssh2


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-41.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
description:
2025-02-05 04:41:10 dovecot_plain authenticator failed for ([210.22.130.22]) [58.246.241.234]:48859: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
description:
Feb  5 04:41:43 ait sshd[341268]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.241.234
description:
Feb  5 04:41:08 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.241.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
description:
Feb  5 04:42:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-02-05 04:42:34 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:33502: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Feb  5 04:42:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.107.193
description:
Feb  5 04:43:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.107.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
description:
2025-02-05 04:43:03 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:38348: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.179.107
description:
[2025-02-05 04:42:22 +0100] info [webmaild] 119.160.179.107 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
description:
Feb  5 04:42:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-02-05 04:42:44 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:45025: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  5 04:42:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 04:42:51 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.74]:51762: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  5 04:43:03 ait sshd[341546]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  5 04:43:03 ait sshd[341546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-02-05 04:43:01 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:46413: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
description:
2025-02-05 04:42:34 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:43901: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
description:
2025-02-05 04:42:40 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:55698: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Feb  5 04:42:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
description:
Feb  5 04:42:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Feb  5 04:42:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
description:
2025-02-05 04:42:58 dovecot_login authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:40561: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 04:42:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
description:
Feb  5 04:42:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-02-05 04:42:39 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:41065: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  5 04:43:26 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
description:
2025-02-05 04:43:08 dovecot_plain authenticator failed for ([92.118.235.228]) [92.118.235.228]:37422: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.170.81
description:
Feb  5 04:43:20 ait sshd[341605]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.170.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-05 04:43:28 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:34772: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
description:
Feb  5 04:43:43 ait sshd[341828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
description:
Feb  5 04:43:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
description:
2025-02-05 04:43:48 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:35190: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
description:
Feb  5 04:43:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.70
description:
[2025-02-05 04:43:11 +0100] info [webmaild] 84.54.70.70 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.170.81
description:
Feb  5 04:43:20 ait sshd[341605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.170.81


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
description:
Feb  5 04:43:43 ait sshd[341828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 115.186.118.146
description:
[2025-02-05 04:43:42 +0100] info [webmaild] 115.186.118.146 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.184.80.194
description:
[2025-02-05 04:44:30 +0100] info [webmaild] 197.184.80.194 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.21.58.141
description:
Feb  5 04:44:40 ait sshd[342109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 65.21.58.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 65.21.58.141
description:
Feb  5 04:44:40 ait sshd[342109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.21.58.141


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.81.117.20
description:
Feb  5 04:44:45 ait sshd[342125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.81.117.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.81.117.20
description:
Feb  5 04:44:45 ait sshd[342125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.81.117.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 04:44:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  5 04:44:57 ait sshd[342200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  5 04:44:57 ait sshd[342200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-02-05 04:45:07 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:33766: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.193.184
description:
[2025-02-05 04:45:05 +0100] info [webmaild] 177.54.193.184 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
description:
Feb  5 04:45:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
description:
2025-02-05 04:45:16 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:36346: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 69.160.120.88
description:
[2025-02-05 04:45:50 +0100] info [webmaild] 69.160.120.88 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Feb  5 04:45:05 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-02-05 04:46:34 dovecot_login authenticator failed for ([50.171.64.170]) [50.171.64.170]:54660: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-02-05 04:46:48 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (prosevol) [81.225.30.107]:53066: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
description:
Feb  5 04:46:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.161.211.221
description:
[2025-02-05 04:46:22 +0100] info [webmaild] 177.161.211.221 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-02-05 04:46:20 dovecot_login authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:34099: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Feb  5 04:46:42 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-02-05 04:46:44 dovecot_plain authenticator failed for (turlinium) [94.140.210.134]:43254: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  5 04:46:44 ait sshd[343039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  5 04:46:17 ait sshd[342849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  5 04:46:17 ait sshd[342849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Feb  5 04:46:18 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Feb  5 04:46:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  5 04:46:44 ait sshd[343039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.6.8.141
description:
[2025-02-05 04:47:12 +0100] info [webmaild] 189.6.8.141 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-05 04:47:15 dovecot_login authenticator failed for ([222.236.59.174]) [222.236.59.174]:46786: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
description:
Feb  5 04:47:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
description:
2025-02-05 04:47:24 dovecot_login authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:48718: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.110.54.214
description:
[2025-02-05 04:47:48 +0100] info [webmaild] 152.110.54.214 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  5 04:47:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.95.16.58
description:
[2025-02-05 04:48:31 +0100] info [webmaild] 187.95.16.58 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
description:
Feb  5 04:48:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
description:
2025-02-05 04:48:51 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:48672: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
description:
Feb  5 04:49:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
description:
2025-02-05 04:49:02 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:44472: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.179.68.22
description:
[2025-02-05 04:49:50 +0100] info [webmaild] 186.179.68.22 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 04:50:02 ait sshd[343869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Feb  5 04:49:18 ait sshd[343682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Feb  5 04:49:18 ait sshd[343682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 04:50:02 ait sshd[343869]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.116.240
description:
[2025-02-05 04:49:04 +0100] info [webmaild] 186.68.116.240 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-02-05 04:50:53 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:25181: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Feb  5 04:50:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-02-05 04:50:56 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:57760: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 04:50:59 ait sshd[344627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.50.206
description:
Feb  5 04:50:04 ait sshd[343869]: Failed password for invalid user admission from 146.190.50.206 port 39786 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.220
description:
Feb  5 04:50:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.220
description:
2025-02-05 04:50:12 dovecot_plain authenticator failed for (phyllic) [65.20.253.220]:43060: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.62.50.131
description:
[2025-02-05 04:50:23 +0100] info [webmaild] 41.62.50.131 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  5 04:50:59 ait sshd[344627]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
description:
2025-02-05 04:51:04 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:59191: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Feb  5 04:50:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Feb  5 04:51:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
description:
Feb  5 04:51:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.75.12
description:
[2025-02-05 04:51:02 +0100] info [webmaild] 37.237.75.12 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-02-05 04:51:02 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:48954: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 04:51:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Feb  5 04:51:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-05 04:51:57 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:59258: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.181.210.18
description:
Feb  5 04:51:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.181.210.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
description:
Feb  5 04:51:07 ait sshd[344645]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-02-05 04:51:14 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:43716: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
description:
2025-02-05 04:51:27 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:51222: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 04:51:39 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:48788: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
description:
2025-02-05 04:51:45 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:57648: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-02-05 04:51:55 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:34768: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-02-05 04:51:55 dovecot_plain authenticator failed for ([220.178.39.106]) [220.178.39.106]:60845: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  5 04:51:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-05 04:52:03 dovecot_plain authenticator failed for ([177.174.85.129]) [177.174.85.137]:39205: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  5 04:51:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 04:51:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
description:
Feb  5 04:51:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.226
description:
2025-02-05 04:51:54 dovecot_plain authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:62404: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-02-05 04:51:55 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:58811: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.216
domain: admission.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-52.20.171.207.216||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
description:
Feb  5 04:52:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.134.209.86
description:
Feb  5 04:51:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.134.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-02-05 04:51:40 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:52009: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-05 04:51:40 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:14664: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
description:
2025-02-05 04:51:41 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:48238: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Feb  5 04:51:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  5 04:51:16 ait sshd[344677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
description:
Feb  5 04:51:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
description:
Feb  5 04:51:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.218
description:
2025-02-05 04:51:39 dovecot_plain authenticator failed for ([103.58.67.218]) [103.58.67.218]:44428: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.72.18.145
description:
Feb  5 04:51:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.72.18.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
description:
2025-02-05 04:51:42 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:57881: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-02-05 04:51:52 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:58662: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  5 04:51:16 ait sshd[344677]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
description:
2025-02-05 04:51:31 dovecot_plain authenticator failed for (sphipeter) [65.20.191.12]:52922: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.176.174.10
description:
[2025-02-05 04:51:33 +0100] info [webmaild] 103.176.174.10 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Feb  5 04:51:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
description:
Feb  5 04:51:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.18.145
description:
2025-02-05 04:51:43 dovecot_plain authenticator failed for (h145-192-72-18.seed.net.tw) [192.72.18.145]:58302: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Feb  5 04:51:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-02-05 04:52:04 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:57823: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Feb  5 04:51:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
description:
Feb  5 04:51:43 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Feb  5 04:51:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
description:
2025-02-05 04:51:30 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:39505: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Feb  5 04:51:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-05 04:51:43 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:1960: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
description:
2025-02-05 04:51:45 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:48690: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.58.25
description:
Feb  5 04:51:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.58.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  5 04:52:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-05 04:51:05 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:52720: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-02-05 04:51:08 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:21121: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
description:
2025-02-05 04:51:22 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:54614: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
description:
Feb  5 04:51:25 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.12
description:
Feb  5 04:51:29 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Feb  5 04:51:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
description:
Feb  5 04:51:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
description:
Feb  5 04:51:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  5 04:51:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.18
description:
2025-02-05 04:51:48 dovecot_plain authenticator failed for ([125.90.72.18]) [125.90.72.18]:37721: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Feb  5 04:51:50 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.181.210.18
description:
2025-02-05 04:51:58 dovecot_plain authenticator failed for ([216.181.210.18]) [216.181.210.18]:45110: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-02-05 04:51:22 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:33824: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.217.199.167
description:
Feb  5 04:51:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.217.199.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.234.154
description:
Feb  5 04:52:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.234.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-02-05 04:51:57 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:54575: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
description:
Feb  5 04:51:07 ait sshd[344645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-02-05 04:51:40 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:47398: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
description:
2025-02-05 04:51:41 dovecot_plain authenticator failed for ([183.134.209.86]) [183.134.209.86]:60485: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-02-05 04:51:42 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:60149: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
description:
2025-02-05 04:51:43 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:37444: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Feb  5 04:51:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
description:
2025-02-05 04:51:09 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:59010: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.226
description:
Feb  5 04:51:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
description:
Feb  5 04:51:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  5 04:51:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-05 04:52:00 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:60144: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
description:
Feb  5 04:51:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.67.218
description:
Feb  5 04:51:37 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.67.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-02-05 04:51:37 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:42600: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  5 04:51:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.18
description:
Feb  5 04:51:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
description:
2025-02-05 04:51:56 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:32922: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.217.199.167
description:
2025-02-05 04:51:57 dovecot_plain authenticator failed for ([114.217.199.167]) [114.217.199.167]:52543: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.148.130.25
description:
Feb  5 04:52:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.148.130.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Feb  5 04:51:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Feb  5 04:51:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.25
description:
2025-02-05 04:51:58 dovecot_plain authenticator failed for ([45.71.58.25]) [45.71.58.25]:58908: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-02-05 04:52:00 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:41004: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-05 04:52:19 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:49896: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  5 04:52:47 ait sshd[345189]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
description:
2025-02-05 04:52:50 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:37396: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.193.83
description:
Feb  5 04:52:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.193.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
description:
Feb  5 04:52:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.234.154
description:
2025-02-05 04:52:05 dovecot_plain authenticator failed for ([183.167.234.154]) [183.167.234.154]:41139: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Feb  5 04:52:11 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-02-05 04:52:13 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:35690: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Feb  5 04:52:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-02-05 04:52:08 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:42934: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-02-05 04:52:12 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:35708: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
description:
Feb  5 04:52:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  5 04:52:47 ait sshd[345189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.117.195
description:
Feb  5 04:52:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.117.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Feb  5 04:52:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.51.38
description:
Feb  5 04:52:42 ait sshd[345185]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.208.51.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Feb  5 04:52:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  5 04:52:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.219.189.255
description:
[2025-02-05 04:52:27 +0100] info [webmaild] 189.219.189.255 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.162
description:
Feb  5 04:53:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.193.83
description:
2025-02-05 04:52:06 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:49157: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.148.130.25
description:
2025-02-05 04:52:05 dovecot_plain authenticator failed for ([197.148.130.25]) [197.148.130.25]:46625: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.117.195
description:
2025-02-05 04:52:09 dovecot_plain authenticator failed for ([112.91.117.195]) [112.91.117.195]:51574: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.190.147.29
description:
Feb  5 04:52:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.190.147.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-02-05 04:52:57 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:57880: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Feb  5 04:52:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
description:
2025-02-05 04:52:15 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:63657: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-02-05 04:52:16 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:39212: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  5 04:52:42 ait sshd[345185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
description:
2025-02-05 04:52:06 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:53525: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.162
description:
2025-02-05 04:53:05 dovecot_login authenticator failed for p7001163-ipoefx.ipoe.ocn.ne.jp [118.3.227.162]:53026: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-02-05 04:54:02 dovecot_login authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:41915: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-02-05 04:54:02 dovecot_login authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:53272: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  5 04:53:28 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-02-05 04:53:30 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:45123: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Feb  5 04:53:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Feb  5 04:54:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.189
description:
2025-02-05 04:53:11 dovecot_login authenticator failed for ([111.61.176.189]) [111.61.176.189]:41074: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.129
description:
Feb  5 04:53:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 04:54:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
description:
Feb  5 04:54:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  5 04:53:58 ait sshd[345500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.59.34.245
description:
Feb  5 04:53:16 ait sshd[345242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.59.34.245


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
description:
Feb  5 04:53:37 ait sshd[345383]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 20.171.207.216
domain: admission.ait.edu.gh
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users/2||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  5 04:53:52 ait sshd[345487]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
description:
Feb  5 04:53:57 ait sshd[345498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.216
domain: admission.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-53.20.171.207.216||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-02-05 04:53:52 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:59914: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  5 04:53:52 ait sshd[345487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  5 04:53:58 ait sshd[345500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.228.39
description:
[2025-02-05 04:53:05 +0100] info [webmaild] 45.184.228.39 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.220.210.141
description:
[2025-02-05 04:53:33 +0100] info [webmaild] 102.220.210.141 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-02-05 04:53:36 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:36762: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Feb  5 04:53:50 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
description:
Feb  5 04:53:37 ait sshd[345383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Feb  5 04:54:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.189
description:
Feb  5 04:53:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.59.34.245
description:
Feb  5 04:53:16 ait sshd[345242]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.59.34.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.162
description:
Feb  5 04:53:49 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.237.129
description:
2025-02-05 04:53:49 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.237.129]:19818: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
description:
Feb  5 04:53:57 ait sshd[345498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-02-05 04:54:05 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:42804: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Feb  5 04:54:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-02-05 04:54:50 dovecot_login authenticator failed for ([60.8.250.139]) [60.8.250.139]:47696: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-02-05 04:54:58 dovecot_login authenticator failed for ([211.105.223.49]) [211.105.223.49]:34322: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.79.38
description:
Feb  5 04:54:36 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.79.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-02-05 04:54:41 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:51402: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.250.139
description:
Feb  5 04:54:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.10.10
description:
2025-02-05 04:55:00 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [186.201.10.10]:52645: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
description:
2025-02-05 04:55:02 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:48936: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.152
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Feb  5 04:54:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
description:
Feb  5 04:54:40 ait sshd[345736]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Feb  5 04:54:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Feb  5 04:54:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
description:
Feb  5 04:54:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
description:
2025-02-05 04:54:58 dovecot_login authenticator failed for ([47.206.63.169]) [47.206.63.169]:55486: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Feb  5 04:54:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.246.138.100
description:
Feb  5 04:54:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.246.138.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.245.202
description:
2025-02-05 04:54:09 dovecot_login authenticator failed for ([218.21.245.202]) [218.21.245.202]:57280: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  5 04:54:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
description:
2025-02-05 04:54:32 dovecot_login authenticator failed for 5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:52212: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-02-05 04:54:46 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:45734: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-02-05 04:54:48 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:58836: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.233
description:
2025-02-05 04:55:02 dovecot_login authenticator failed for ([104.241.233.233]) [104.241.233.233]:59772: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.245.202
description:
Feb  5 04:54:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.245.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.29.53
description:
2025-02-05 04:54:15 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:44898: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.198.73
description:
Feb  5 04:54:30 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.198.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.79.38
description:
2025-02-05 04:54:38 dovecot_login authenticator failed for ([211.178.79.38]) [211.178.79.38]:38465: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Feb  5 04:54:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.10.10
description:
Feb  5 04:54:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.10.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-02-05 04:55:00 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:33413: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.233
description:
Feb  5 04:55:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.233 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.216.142.169
description:
[2025-02-05 04:54:06 +0100] info [webmaild] 45.216.142.169 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Feb  5 04:55:03 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.138.100
description:
2025-02-05 04:54:16 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:51530: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
description:
Feb  5 04:54:40 ait sshd[345736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
description:
Feb  5 04:54:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-02-05 04:54:58 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:37379: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
description:
Feb  5 04:55:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-05 04:54:15 dovecot_login authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:35309: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.37.144
description:
Feb  5 04:55:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.37.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.10.194.229
description:
2025-02-05 04:55:43 dovecot_plain authenticator failed for ([204.10.194.229]) [204.10.194.229]:51682: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-02-05 04:55:57 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:42602: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  5 04:55:59 ait sshd[346488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  5 04:55:59 ait sshd[346488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-02-05 04:55:59 dovecot_login authenticator failed for ([103.178.158.132]) [103.178.158.132]:60544: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-02-05 04:55:05 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:50038: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Feb  5 04:55:19 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-02-05 04:55:33 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:38690: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Feb  5 04:55:51 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.139.182.85
description:
Feb  5 04:56:01 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.139.182.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-02-05 04:56:04 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:42148: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Feb  5 04:55:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.82.131.20
description:
2025-02-05 04:55:19 dovecot_login authenticator failed for ([184.82.131.20]) [184.82.131.20]:46028: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.37.144
description:
2025-02-05 04:55:43 dovecot_login authenticator failed for ([220.180.37.144]) [220.180.37.144]:49681: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
description:
2025-02-05 04:55:09 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:36761: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-02-05 04:55:21 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:37060: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  5 04:55:39 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 204.10.194.229
description:
[2025-02-05 04:56:04 +0100] info [webmaild] 204.10.194.229 - ads21b00230y@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Feb  5 04:56:02 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-02-05 04:55:12 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:44172: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-02-05 04:55:50 dovecot_login authenticator failed for ([211.57.111.99]) [211.57.111.99]:57248: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.237.8.37
description:
2025-02-05 04:55:47 dovecot_login authenticator failed for ([58.237.8.37]) [58.237.8.37]:59463: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Feb  5 04:55:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Feb  5 04:55:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Feb  5 04:55:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  5 04:55:48 ait sshd[346446]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  5 04:55:48 ait sshd[346446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Feb  5 04:55:55 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.217.156.135
description:
[2025-02-05 04:56:00 +0100] info [webmaild] 62.217.156.135 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Feb  5 04:55:40 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-02-05 04:55:42 dovecot_login authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:58947: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.139.182.85
description:
2025-02-05 04:56:03 dovecot_plain authenticator failed for ([43.139.182.85]) [43.139.182.85]:43416: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.82.131.20
description:
Feb  5 04:55:17 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.82.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.57.55
description:
[2025-02-05 04:55:23 +0100] info [webmaild] 177.125.57.55 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-05 04:55:41 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:2059: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.237.8.37
description:
Feb  5 04:55:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.237.8.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-02-05 04:55:53 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:52413: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Feb  5 04:55:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.218.95.154
description:
Feb  5 04:55:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.218.95.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-02-05 04:55:14 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:3349: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 204.10.194.229
description:
[2025-02-05 04:56:04 +0100] info [cpaneld] 204.10.194.229 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-02-05 04:56:16 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:53994: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.201.3
description:
[2025-02-05 04:56:42 +0100] info [webmaild] 187.73.201.3 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.127.177.194
description:
Feb  5 04:56:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.127.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
description:
2025-02-05 04:56:17 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:45583: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Feb  5 04:56:31 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Feb  5 04:56:27 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.34.186
description:
47.128.34.186 - - [05/Feb/2025:04:57:00 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7603482" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.34.186


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  5 04:56:56 ait sshd[346734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  5 04:57:00 ait sshd[346739]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Feb  5 04:56:05 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-02-05 04:56:07 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:34426: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-56.80.76.51.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.207
description:
47.128.43.207 - - [05/Feb/2025:04:56:07 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14735726 HTTP/2.0" 302 0 gou.university "https://gou.university/programmes/master-of-science-msc-in-crop-science/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
description:
2025-02-05 04:56:17 dovecot_login authenticator failed for ([183.249.1.82]) [183.249.1.82]:46661: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-02-05 04:56:33 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:39256: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
description:
Feb  5 04:56:56 ait sshd[346734]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  5 04:57:00 ait sshd[346739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Feb  5 04:56:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-02-05 04:56:29 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:47857: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.82.218
description:
[2025-02-05 04:56:08 +0100] info [webmaild] 187.73.82.218 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
description:
Feb  5 04:56:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.189
description:
Feb  5 04:57:31 ait sshd[346813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.189


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.189
description:
Feb  5 04:57:31 ait sshd[346813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Feb  5 04:57:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-02-05 04:57:55 dovecot_plain authenticator failed for ([41.67.143.142]) [41.67.143.142]:60118: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.134.217.51
description:
[2025-02-05 04:58:02 +0100] info [webmaild] 103.134.217.51 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  5 04:58:06 ait sshd[347017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.97.204.162
description:
[2025-02-05 04:58:40 +0100] info [webmaild] 177.97.204.162 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.13.139
description:
[2025-02-05 04:58:43 +0100] info [webmaild] 45.70.13.139 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.144.82.250
description:
Feb  5 04:58:13 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.144.82.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.144.82.250
description:
2025-02-05 04:58:15 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:36870: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  5 04:59:16 ait sshd[347309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  5 04:59:16 ait sshd[347309]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.93.127.183
description:
[2025-02-05 04:59:16 +0100] info [webmaild] 197.93.127.183 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
description:
Feb  5 04:59:59 ait sshd[347518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
description:
Feb  5 04:59:59 ait sshd[347518]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
description:
Feb  5 05:00:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
description:
2025-02-05 05:00:43 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:57682: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.49.175
description:
[2025-02-05 05:00:46 +0100] info [webmaild] 191.5.49.175 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.183.86.2
description:
Feb  5 05:00:16 ait sshd[347929]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.183.86.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.183.86.2
description:
Feb  5 05:00:16 ait sshd[347929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.86.2  user=operator


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.71.109
description:
Feb  5 05:00:21 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.71.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
description:
2025-02-05 05:00:23 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:50256: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.109.44
description:
[2025-02-05 05:01:26 +0100] info [webmaild] 177.54.109.44 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.112.81
description:
[2025-02-05 05:02:00 +0100] info [webmaild] 177.222.112.81 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 05:01:10 ait sshd[348299]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 05:01:10 ait sshd[348299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.253.4
description:
[2025-02-05 05:01:23 +0100] info [webmaild] 186.194.253.4 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.152
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 05:01:44 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  5 05:02:17 ait sshd[348582]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Feb  5 05:02:33 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.112.190
description:
2025-02-05 05:02:55 dovecot_plain authenticator failed for ([60.219.112.190]) [60.219.112.190]:56796: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.90.118
description:
Feb  5 05:02:06 ait sshd[348551]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.90.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
description:
Feb  5 05:02:39 ait sshd[348643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
description:
Feb  5 05:02:39 ait sshd[348643]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Feb  5 05:02:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.112.190
description:
Feb  5 05:02:53 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.112.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-02-05 05:02:54 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:60146: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.90.118
description:
Feb  5 05:02:06 ait sshd[348551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.90.118


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  5 05:02:17 ait sshd[348582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-02-05 05:02:35 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:43024: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Feb  5 05:03:22 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-02-05 05:03:24 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net (hagnegism) [69.124.10.62]:42490: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-02-05 05:03:34 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:60934: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Feb  5 05:03:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-02-05 05:03:50 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:40249: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Feb  5 05:03:32 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.94.73
description:
[2025-02-05 05:03:36 +0100] info [webmaild] 45.185.94.73 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.77
description:
Feb  5 05:04:24 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.74.132.59
description:
[2025-02-05 05:04:38 +0100] info [webmaild] 201.74.132.59 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-02-05 05:04:48 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:33483: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.98.177.66
description:
Feb  5 05:04:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.98.177.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.168.112.13
description:
[2025-02-05 05:04:16 +0100] info [webmaild] 152.168.112.13 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 05:04:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.77
description:
2025-02-05 05:04:26 dovecot_login authenticator failed for ([111.61.176.77]) [111.61.176.77]:38706: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  5 05:04:33 ait sshd[349140]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  5 05:05:04 ait sshd[349528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Feb  5 05:04:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
description:
2025-02-05 05:04:11 dovecot_plain authenticator failed for ([112.98.177.66]) [112.98.177.66]:58649: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  5 05:04:33 ait sshd[349140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Feb  5 05:04:46 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  5 05:05:04 ait sshd[349528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.221.205.176
description:
[2025-02-05 05:04:05 +0100] info [webmaild] 176.221.205.176 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  5 05:04:17 ait sshd[349117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-02-05 05:04:09 dovecot_login authenticator failed for ([38.49.182.103]) [38.49.182.103]:48948: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
description:
Feb  5 05:05:09 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
description:
2025-02-05 05:05:11 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:34984: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  5 05:05:09 ait sshd[349549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
description:
Feb  5 05:05:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-02-05 05:05:58 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:50643: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  5 05:05:28 ait sshd[349677]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  5 05:05:28 ait sshd[349677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
description:
2025-02-05 05:05:47 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:41234: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Feb  5 05:05:56 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.254.23.40
description:
Feb  5 05:05:06 ait sshd[349528]: Failed password for invalid user perl from 178.254.23.40 port 44054 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  5 05:05:09 ait sshd[349549]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-02-05 05:06:50 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:43390: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-05 05:06:54 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:61041: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 84.247.179.135
domain: www.iloveait.ait-edu.us
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config.properties.bak||User:titlemas||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.249.14.220
description:
[2025-02-05 05:06:51 +0100] info [webmaild] 41.249.14.220 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  5 05:06:44 ait sshd[350130]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Feb  5 05:06:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.2.13
description:
[2025-02-05 05:06:23 +0100] info [webmaild] 143.255.2.13 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
description:
2025-02-05 05:06:56 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:46434: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.21.43
description:
[2025-02-05 05:07:00 +0100] info [webmaild] 170.84.21.43 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-02-05 05:06:49 dovecot_login authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:49093: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.189.151
description:
Feb  5 05:06:58 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.189.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
description:
2025-02-05 05:07:00 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:39950: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Feb  5 05:06:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  5 05:06:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
description:
Feb  5 05:06:54 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  5 05:06:44 ait sshd[350130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.222.174.49
description:
2025-02-05 05:07:16 dovecot_login authenticator failed for ([102.222.174.49]) [102.222.174.49]:33810: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.242.1
description:
[2025-02-05 05:07:25 +0100] info [webmaild] 45.234.242.1 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
description:
2025-02-05 05:07:37 dovecot_login authenticator failed for ([47.206.63.169]) [47.206.63.169]:59734: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
description:
Feb  5 05:08:04 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  5 05:07:08 ait sshd[350341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-05 05:07:08 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:46280: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.222.174.49
description:
Feb  5 05:07:14 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.222.174.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  5 05:07:12 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-02-05 05:07:17 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:60366: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.250.139
description:
Feb  5 05:07:29 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-02-05 05:07:31 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.250.139]:13106: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Feb  5 05:07:48 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.37.73.242
description:
Feb  5 05:07:59 ait sshd[350532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.37.73.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Feb  5 05:07:15 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-05 05:07:14 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:8774: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-02-05 05:07:50 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:37956: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.73.242
description:
Feb  5 05:07:59 ait sshd[350532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.37.73.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  5 05:07:06 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
description:
Feb  5 05:07:35 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
description:
2025-02-05 05:08:06 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:34334: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 05:08:07 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  5 05:08:10 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-05 05:08:12 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:53512: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.145.202
description:
Feb  5 05:10:00 ait sshd[351031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.145.202


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.87.46.53
description:
[2025-02-05 05:09:08 +0100] info [webmaild] 201.87.46.53 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.202.36
description:
[2025-02-05 05:09:44 +0100] info [webmaild] 181.78.202.36 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.131.75.42
description:
[2025-02-05 05:09:58 +0100] info [webmaild] 31.131.75.42 - sales@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
description:
Feb  5 05:10:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Feb  5 05:09:39 ait sshd[350883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.234.69
description:
Feb  5 05:09:47 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.234.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.152
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/engine1/images/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.108.124.204
description:
[2025-02-05 05:09:26 +0100] info [webmaild] 176.108.124.204 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Feb  5 05:09:39 ait sshd[350883]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.209.153
description:
2025-02-05 05:10:02 dovecot_login authenticator failed for ([39.174.209.153]) [39.174.209.153]:38028: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.234.69
description:
2025-02-05 05:09:49 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:52732: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.145.202
description:
Feb  5 05:10:00 ait sshd[351031]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.145.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 05:10:58 ait sshd[351685]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
description:
Feb  5 05:10:45 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-02-05 05:10:47 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:34952: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
description:
Feb  5 05:10:59 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 05:10:58 ait sshd[351685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
description:
2025-02-05 05:11:01 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:44442: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  5 05:10:20 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-05 05:10:22 dovecot_plain authenticator failed for (queuteess) [88.87.84.104]:60687: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Feb  5 05:11:34 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Feb  5 05:11:38 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.160.42
description:
2025-02-05 05:11:54 dovecot_plain authenticator failed for ([117.158.160.42]) [117.158.160.42]:40496: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.76.68.170
description:
[2025-02-05 05:11:56 +0100] info [webmaild] 185.76.68.170 - sales@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  5 05:11:41 ait sshd[351850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.236.91.93
description:
2025-02-05 05:11:59 dovecot_login authenticator failed for (hn.kd.ny.adsl) [42.236.91.93]:39654: 535 Incorrect authentication data (set_id=swanzy)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-11.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-02-05 05:11:36 dovecot_login authenticator failed for ([210.12.68.242]) [210.12.68.242]:49404: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Feb  5 05:11:41 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  5 05:11:41 ait sshd[351850]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.160.42
description:
Feb  5 05:11:52 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.160.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-05 05:12:02 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:51438: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-02-05 05:11:40 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:40734: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-02-05 05:11:43 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:36698: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.236.91.93
description:
Feb  5 05:11:57 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.236.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  5 05:12:00 ait auth[326696]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.46.157
description:
[2025-02-05 05:12:06 +0100] info [webmaild] 179.189.46.157 - sales@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.129.26
description:
2025-02-05 05:12:08 dovecot_plain authenticator failed for bb115-66-129-26.singnet.com.sg [115.66.129.26]:60534: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.132.40.77
description:
2025-02-05 05:12:19 dovecot_plain authenticator failed for ([45.132.40.77]) [45.132.40.77]:54196: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  5 05:12:20 ait sshd[352036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.231.79.16
description:
[2025-02-05 05:12:34 +0100] info [webmaild] 66.231.79.16 - sales@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


