# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.181.0.212
description:
[2025-02-04 05:44:22 +0100] info [webmaild] 177.181.0.212 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
description:
2025-02-04 05:44:22 dovecot_plain authenticator failed for ([36.154.134.146]) [36.154.134.146]:37200: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-02-04 05:43:38 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:7415: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-02-04 05:43:48 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:47138: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.230
description:
2025-02-04 05:43:56 dovecot_plain authenticator failed for ([113.64.208.230]) [113.64.208.230]:43115: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-02-04 05:44:02 dovecot_plain authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:48643: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
description:
Feb  4 05:43:38 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-02-04 05:43:40 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:50726: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
description:
2025-02-04 05:43:43 dovecot_plain authenticator failed for ([1.27.171.154]) [1.27.171.154]:50054: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
description:
2025-02-04 05:43:43 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:49636: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-02-04 05:43:53 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:37510: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.230
description:
Feb  4 05:43:54 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.31
description:
2025-02-04 05:44:11 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:46230: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.13.24
description:
Feb  4 05:43:40 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.13.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.120.180.144
description:
2025-02-04 05:43:46 dovecot_plain authenticator failed for ([1.71.191.42]) [171.120.180.144]:4660: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.151.194
description:
Feb  4 05:43:55 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.151.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.39.15.134
description:
[2025-02-04 05:44:06 +0100] info [webmaild] 110.39.15.134 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.137.26
description:
2025-02-04 05:44:48 dovecot_plain authenticator failed for ([112.28.137.26]) [112.28.137.26]:37634: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
description:
Feb  4 05:44:57 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.51.92.242
description:
[2025-02-04 05:44:38 +0100] info [webmaild] 189.51.92.242 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.223.55.246
description:
Feb  4 05:44:50 ait sshd[3927143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.55.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
description:
2025-02-04 05:44:59 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:49250: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.137.26
description:
Feb  4 05:44:46 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.55.246
description:
Feb  4 05:44:50 ait sshd[3927143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.223.55.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Feb  4 05:45:48 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-02-04 05:45:50 dovecot_login authenticator failed for ([125.142.39.13]) [125.142.39.13]:40194: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.55.246
description:
Feb  4 05:46:12 ait sshd[3927647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.223.55.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.223.55.246
description:
Feb  4 05:46:12 ait sshd[3927647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.55.246


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.55.246
description:
Feb  4 05:46:14 ait sshd[3927647]: Failed password for invalid user universal from 159.223.55.246 port 46840 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
description:
Feb  4 05:45:37 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
description:
2025-02-04 05:45:39 dovecot_login authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:47066: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.56.194.205
description:
[2025-02-04 05:46:18 +0100] info [webmaild] 185.56.194.205 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.170.154
description:
Feb  4 05:46:24 ait sshd[3927730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.170.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.138.250.58
description:
[2025-02-04 05:46:38 +0100] info [webmaild] 103.138.250.58 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.188.247.176
description:
[2025-02-04 05:46:52 +0100] info [webmaild] 177.188.247.176 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.156.209
description:
[2025-02-04 05:47:08 +0100] info [webmaild] 177.67.156.209 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.161.58
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS24A00072Y||WPU:ADS24A00072Y||RSV:6.65||T:APACHE||MV:05-47.45.61.161.58


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.170.154
description:
Feb  4 05:48:29 ait sshd[3928575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.170.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
description:
[2025-02-04 05:47:48 +0100] info [cpaneld] 147.45.44.84 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Feb  4 05:49:03 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-02-04 05:49:05 dovecot_login authenticator failed for ([1.242.165.148]) [1.242.165.148]:59115: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.106.214
description:
[2025-02-04 05:49:15 +0100] info [webmaild] 45.4.106.214 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.222.111.79
description:
[2025-02-04 05:49:22 +0100] info [webmaild] 77.222.111.79 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-02-04 05:49:37 dovecot_login authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:36186: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Feb  4 05:48:39 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-02-04 05:48:41 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:48324: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.247.100.74
description:
[2025-02-04 05:48:47 +0100] info [webmaild] 91.247.100.74 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Feb  4 05:49:35 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 05:50:04 ait sshd[3929221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 05:50:08 ait sshd[3929233]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Feb  4 05:50:18 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 05:49:49 dovecot_login authenticator failed for ([112.111.61.232]) [112.111.61.229]:53136: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-02-04 05:49:51 dovecot_login authenticator failed for ([220.248.205.15]) [220.248.205.14]:1248: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.210.119
description:
Feb  4 05:50:01 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.210.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-02-04 05:50:09 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:37284: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 05:50:04 ait sshd[3929221]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Feb  4 05:50:07 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 05:50:03 ait sshd[3929221]: Invalid user business-development-germany.de 2a00 from 122.51.104.242 port 36794


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 05:49:47 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 05:50:08 ait sshd[3929233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-02-04 05:50:20 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:35923: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Feb  4 05:49:49 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.62.62.23
description:
[2025-02-04 05:49:49 +0100] info [webmaild] 179.62.62.23 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
description:
2025-02-04 05:50:03 dovecot_login authenticator failed for ([103.203.210.119]) [103.203.210.119]:40423: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.221
description:
Feb  4 05:51:33 ait sshd[3929720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.221  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.196.141
description:
Feb  4 05:50:45 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.196.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Feb  4 05:51:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.28
description:
2025-02-04 05:51:03 dovecot_login authenticator failed for (ADMIN) [77.81.142.28]:53538: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-02-04 05:51:04 dovecot_login authenticator failed for ([1.237.137.30]) [1.237.137.30]:45956: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.37
description:
Feb  4 05:51:05 ait sshd[3929661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.37


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.196.141
description:
2025-02-04 05:50:47 dovecot_login authenticator failed for ([120.238.196.141]) [120.238.196.141]:54492: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.221
description:
Feb  4 05:51:33 ait sshd[3929720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.37
description:
Feb  4 05:51:05 ait sshd[3929661]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.154.53
description:
[2025-02-04 05:52:30 +0100] info [webmaild] 186.225.154.53 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.221
description:
Feb  4 05:51:39 ait sshd[3929720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.136.169.220
description:
[2025-02-04 05:52:03 +0100] info [webmaild] 177.136.169.220 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.172.165
description:
2025-02-04 05:52:19 dovecot_plain authenticator failed for (bulgors) [65.20.172.165]:41142: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.165
description:
Feb  4 05:52:17 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.165 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.221
description:
Feb  4 05:51:45 ait sshd[3929766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.221  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.21.72
description:
[2025-02-04 05:51:56 +0100] info [webmaild] 189.106.21.72 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.68.169.181
description:
Feb  4 05:52:02 ait sshd[3930112]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.68.169.181 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.68.169.181
description:
Feb  4 05:52:02 ait sshd[3930112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.68.169.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.191.42.194
description:
[2025-02-04 05:52:32 +0100] info [webmaild] 187.191.42.194 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.110
description:
[2025-02-04 05:53:13 +0100] info [cpaneld] 156.228.116.110 - eng15a00111y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng15a00111y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.248
description:
[2025-02-04 05:53:13 +0100] info [cpaneld] 156.228.105.248 - eng15a00111y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng15a00111y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.209
description:
[2025-02-04 05:53:14 +0100] info [whostmgrd] 104.207.55.209 - eng15a00111y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.213
description:
[2025-02-04 05:53:16 +0100] info [whostmgrd] 104.207.38.213 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.41
description:
[2025-02-04 05:53:17 +0100] info [whostmgrd] 156.228.96.41 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.37.92
description:
[2025-02-04 05:53:17 +0100] info [whostmgrd] 104.207.37.92 - eng15a00111y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-52.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.239
description:
[2025-02-04 05:53:12 +0100] info [cpaneld] 156.228.91.239 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.241
description:
[2025-02-04 05:53:18 +0100] info [whostmgrd] 104.207.39.241 - eng15a00111y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.208
description:
[2025-02-04 05:53:12 +0100] info [cpaneld] 156.228.117.208 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.197
description:
[2025-02-04 05:53:14 +0100] info [whostmgrd] 156.228.98.197 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.107.153
description:
[2025-02-04 05:53:11 +0100] info [cpaneld] 156.228.107.153 - eng15a00111y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eng15a00111y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-02-04 05:54:21 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:42374: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 05:54:35 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:38378: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.44.76.103
description:
Feb  4 05:54:30 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.44.76.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.62
description:
Feb  4 05:53:45 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
description:
Feb  4 05:54:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
description:
2025-02-04 05:54:21 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:52008: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-02-04 05:54:32 dovecot_plain authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:35770: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 05:54:33 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.62
description:
2025-02-04 05:53:47 dovecot_plain authenticator failed for (fislies) [62.182.116.62]:44569: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
description:
Feb  4 05:54:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.16.76
description:
[2025-02-04 05:54:28 +0100] info [webmaild] 170.245.16.76 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.39.117.150
description:
[2025-02-04 05:54:37 +0100] info [webmaild] 212.39.117.150 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-02-04 05:54:44 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:39470: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Feb  4 05:55:13 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
description:
2025-02-04 05:55:15 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:6753: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
description:
2025-02-04 05:55:23 dovecot_plain authenticator failed for ([222.235.82.88]) [222.235.82.88]:42104: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Feb  4 05:55:35 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.158.123.31
description:
[2025-02-04 05:55:00 +0100] info [webmaild] 146.158.123.31 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
description:
Feb  4 05:55:27 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.23
description:
Feb  4 05:55:33 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
description:
Feb  4 05:55:35 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 05:55:35 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:49219: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-02-04 05:54:43 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:50021: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-02-04 05:55:04 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:56126: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.253.159
description:
[2025-02-04 05:55:09 +0100] info [webmaild] 179.127.253.159 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-04 05:55:18 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:35428: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
description:
Feb  4 05:55:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
description:
2025-02-04 05:55:21 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:51236: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Feb  4 05:54:42 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
description:
Feb  4 05:55:13 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
description:
2025-02-04 05:55:29 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:44352: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
description:
2025-02-04 05:55:35 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:19629: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Feb  4 05:55:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-02-04 05:55:15 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:46606: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-02-04 05:55:01 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:37624: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
description:
Feb  4 05:55:21 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Feb  4 05:54:41 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  4 05:55:16 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 05:55:33 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-02-04 05:55:37 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:45458: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
description:
2025-02-04 05:55:37 dovecot_login authenticator failed for ([92.124.143.165]) [92.124.143.165]:58344: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.177.88.62
description:
Feb  4 05:55:57 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.177.88.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
description:
Feb  4 05:56:12 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
description:
2025-02-04 05:56:14 dovecot_login authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:34410: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-02-04 05:56:21 dovecot_login authenticator failed for ([177.2.161.89]) [177.2.161.66]:40153: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.24.152.80
description:
Feb  4 05:55:50 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.24.152.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.24.152.80
description:
2025-02-04 05:55:52 dovecot_plain authenticator failed for ([50.24.152.80]) [50.24.152.80]:42071: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.62
description:
2025-02-04 05:55:59 dovecot_login authenticator failed for ([186.177.88.62]) [186.177.88.62]:53755: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
description:
Feb  4 05:56:07 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  4 05:56:08 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Feb  4 05:56:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
description:
2025-02-04 05:56:30 dovecot_login authenticator failed for ([1.236.156.129]) [1.236.156.129]:57436: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Feb  4 05:56:36 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-02-04 05:56:38 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:34926: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
description:
2025-02-04 05:56:09 dovecot_login authenticator failed for ([38.187.146.68]) [38.187.146.68]:36625: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-04 05:56:10 dovecot_login authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:46559: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.68.169.181
description:
Feb  4 05:56:15 ait sshd[3931594]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.68.169.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
description:
Feb  4 05:56:28 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.60.143
description:
Feb  4 05:56:37 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.60.143 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.68.169.181
description:
Feb  4 05:56:15 ait sshd[3931594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.68.169.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Feb  4 05:56:38 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.251.230.175
description:
Feb  4 05:56:49 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.251.230.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.192.166
description:
[2025-02-04 05:57:06 +0100] info [webmaild] 198.163.192.166 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.222.31.83
description:
[2025-02-04 05:57:11 +0100] info [webmaild] 201.222.31.83 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.253.100
description:
[2025-02-04 05:57:36 +0100] info [webmaild] 45.231.253.100 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.60.143
description:
2025-02-04 05:56:39 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.60.143]:24709: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-02-04 05:56:40 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:58798: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 05:56:57 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.251.230.175
description:
2025-02-04 05:56:51 dovecot_plain authenticator failed for ([183.251.230.175]) [183.251.230.175]:34120: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Feb  4 05:58:04 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-02-04 05:58:06 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:45654: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Feb  4 05:58:36 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-02-04 05:58:38 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:47472: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.26.41.66
description:
[2025-02-04 05:57:44 +0100] info [webmaild] 37.26.41.66 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
description:
Feb  4 05:57:48 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
description:
2025-02-04 05:57:50 dovecot_login authenticator failed for ([27.72.103.74]) [27.72.103.74]:56969: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.233.188
description:
2025-02-04 05:59:02 dovecot_login authenticator failed for ([178.216.233.188]) [178.216.233.188]:59105: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.174.35
description:
Feb  4 05:59:32 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.174.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 05:59:32 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Feb  4 05:58:48 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-02-04 05:58:50 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:49579: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
description:
Feb  4 05:59:21 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.70.182.172
description:
[2025-02-04 05:59:34 +0100] info [webmaild] 186.70.182.172 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 05:59:34 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:62971: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.195.160
description:
Feb  4 05:58:51 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.195.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.233.188
description:
Feb  4 05:59:00 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.233.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 05:59:06 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
description:
2025-02-04 05:59:34 dovecot_login authenticator failed for ([122.186.174.35]) [122.186.174.35]:57952: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-02-04 05:58:53 dovecot_login authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:33554: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.117.172
description:
47.128.117.172 - - [04/Feb/2025:05:59:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19696958 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.117.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-02-04 05:59:23 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:52584: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-02-04 05:59:47 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:49718: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 14.1.106.230
description:
[2025-02-04 06:00:03 +0100] info [webmaild] 14.1.106.230 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
description:
2025-02-04 06:00:13 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:53644: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.42.0
description:
[2025-02-04 06:00:29 +0100] info [webmaild] 138.36.42.0 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-04 06:00:02 dovecot_plain authenticator failed for (187-8-108-170.customer.tdatabrasil.net.br) [189.56.217.183]:41527: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
description:
2025-02-04 06:00:14 dovecot_login authenticator failed for ([203.192.247.84]) [203.192.247.84]:55748: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.30.170
description:
Feb  4 06:00:36 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.30.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-02-04 05:59:58 dovecot_login authenticator failed for ([59.97.139.38]) [59.97.139.38]:49368: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Feb  4 06:00:00 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 05:59:43 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Feb  4 05:59:45 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  4 05:59:53 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-04 05:59:55 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (ditediness) [176.37.212.85]:35639: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.92.250
description:
[2025-02-04 05:59:56 +0100] info [webmaild] 213.230.92.250 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Feb  4 05:59:56 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.100.181
description:
Feb  4 06:00:11 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.247.84
description:
Feb  4 06:00:12 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.247.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
description:
2025-02-04 06:00:38 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:45520: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.225.46
description:
Feb  4 06:00:39 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.225.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.225.46
description:
2025-02-04 06:00:41 dovecot_login authenticator failed for ([58.58.225.46]) [58.58.225.46]:47055: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 06:00:53 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.249.36.3
description:
2025-02-04 06:00:53 dovecot_login authenticator failed for ([183.71.251.66]) [113.249.36.3]:19678: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Feb  4 06:01:12 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Feb  4 06:01:22 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
description:
Feb  4 06:00:47 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.239.76
description:
2025-02-04 06:00:55 dovecot_plain authenticator failed for ([175.207.239.76]) [175.207.239.76]:41843: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.177.96.5
description:
Feb  4 06:01:06 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.177.96.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.177.96.5
description:
2025-02-04 06:01:08 dovecot_plain authenticator failed for ([117.177.96.5]) [117.177.96.5]:55168: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-02-04 06:01:24 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:48062: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
description:
2025-02-04 06:00:49 dovecot_plain authenticator failed for (58-115-53-66.twt1.com.tw) [58.115.53.66]:44828: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.239.76
description:
Feb  4 06:00:53 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.239.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-02-04 06:01:14 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:45565: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.249.36.3
description:
Feb  4 06:00:51 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.249.36.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.99.146.4
description:
Feb  4 06:01:26 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.99.146.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.146.4
description:
2025-02-04 06:01:28 dovecot_plain authenticator failed for (protorysh) [37.99.146.4]:61881: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.250
description:
2025-02-04 06:02:38 dovecot_plain authenticator failed for ([27.40.100.250]) [27.40.100.250]:40439: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.250
description:
Feb  4 06:02:36 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.118.148.39
description:
[2025-02-04 06:02:24 +0100] info [webmaild] 200.118.148.39 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.12.134
description:
Feb  4 06:02:24 ait sshd[3934130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.12.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.122.127
description:
[2025-02-04 06:02:32 +0100] info [webmaild] 170.80.122.127 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 06:01:56 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.79.180.181
description:
[2025-02-04 06:02:02 +0100] info [webmaild] 187.79.180.181 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.12.134
description:
Feb  4 06:02:24 ait sshd[3934130]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.12.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.230.179
description:
Feb  4 06:02:53 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.230.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
description:
Feb  4 06:03:21 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-02-04 06:02:58 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:36367: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.226.218.185
description:
2025-02-04 06:03:05 dovecot_login authenticator failed for 168-226-218-185.static.speedy.com.ar [168.226.218.185]:43194: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
description:
2025-02-04 06:03:23 dovecot_plain authenticator failed for ([178.178.194.203]) [178.178.194.203]:58830: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
description:
Feb  4 06:02:43 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-02-04 06:02:55 dovecot_plain authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:5396: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Feb  4 06:02:57 ait sshd[3934208]: Invalid user business-development-germany.de 2a00 from 122.51.104.242 port 55962


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 06:02:57 ait sshd[3934208]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-04 06:03:36 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:51374: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
description:
Feb  4 06:02:42 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.97.198
description:
Feb  4 06:03:24 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.97.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-04 06:03:36 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (peride) [91.56.31.167]:61987: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
description:
2025-02-04 06:02:45 dovecot_login authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:52886: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
description:
2025-02-04 06:02:55 dovecot_login authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:44310: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  4 06:03:34 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 06:03:11 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
description:
2025-02-04 06:03:26 dovecot_plain authenticator failed for ([197.156.97.198]) [197.156.97.198]:47402: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 06:02:57 ait sshd[3934208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Feb  4 06:03:08 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-02-04 06:03:10 dovecot_login authenticator failed for ([5.31.16.135]) [5.31.16.135]:55497: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  4 06:03:34 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-04 06:03:38 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:54572: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Feb  4 06:02:53 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.13.171
description:
[2025-02-04 06:02:59 +0100] info [webmaild] 169.224.13.171 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  4 06:03:22 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
description:
2025-02-04 06:02:44 dovecot_login authenticator failed for ([197.242.170.10]) [197.242.170.10]:63034: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Feb  4 06:02:56 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
description:
Feb  4 06:02:43 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
description:
2025-02-04 06:02:45 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:48754: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-04 06:03:24 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:44080: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  4 06:03:36 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Feb  4 06:04:32 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
description:
2025-02-04 06:04:11 dovecot_plain authenticator failed for ([103.190.91.99]) [103.190.91.99]:52930: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-02-04 06:04:18 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:60256: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
description:
2025-02-04 06:04:23 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.28]:43957: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
description:
Feb  4 06:04:24 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-02-04 06:04:29 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:59110: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-02-04 06:03:45 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:61693: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
description:
Feb  4 06:04:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Feb  4 06:04:16 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-02-04 06:04:16 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:32994: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 06:04:10 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
description:
2025-02-04 06:04:16 dovecot_plain authenticator failed for ([46.45.218.48]) [46.45.218.48]:54134: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  4 06:04:14 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.37.17
description:
2025-02-04 06:04:17 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:50541: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.243.136.120
description:
Feb  4 06:04:25 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.243.136.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.145.123
description:
Feb  4 06:04:33 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.145.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
description:
Feb  4 06:04:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
description:
Feb  4 06:04:03 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-02-04 06:04:18 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:54356: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.119
description:
2025-02-04 06:04:20 dovecot_plain authenticator failed for st7031.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.119]:43014: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
description:
2025-02-04 06:04:01 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:42534: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-02-04 06:04:03 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:20020: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Feb  4 06:04:08 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
description:
2025-02-04 06:04:19 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:55204: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.243.136.120
description:
2025-02-04 06:04:27 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:45831: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Feb  4 06:04:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.99
description:
Feb  4 06:04:09 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Feb  4 06:04:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
description:
2025-02-04 06:04:22 dovecot_plain authenticator failed for (23-94-85-164-host.colocrossing.com) [23.94.85.164]:37244: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.121
description:
2025-02-04 06:04:19 dovecot_plain authenticator failed for h-46-59-90-121.a463.priv.bahnhof.se [46.59.90.121]:42131: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.17.46.166
description:
Feb  4 06:04:32 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.17.46.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-02-04 06:04:35 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:48744: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
description:
2025-02-04 06:04:04 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:60405: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-04 06:04:37 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:53814: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.184.143.93
description:
Feb  4 06:04:25 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.184.143.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.17.46.166
description:
2025-02-04 06:04:34 dovecot_plain authenticator failed for (166.46.17.175.adsl-pool.jlccptt.net.cn) [175.17.46.166]:19054: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
description:
Feb  4 06:04:09 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.119
description:
Feb  4 06:04:18 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  4 06:04:38 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
description:
2025-02-04 06:04:07 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:60772: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-02-04 06:04:10 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:53874: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
description:
2025-02-04 06:04:16 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:48942: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-02-04 06:04:21 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:33218: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Feb  4 06:04:33 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Feb  4 06:04:16 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.134
description:
Feb  4 06:04:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
description:
2025-02-04 06:04:05 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:43300: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-02-04 06:04:21 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:47423: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 06:04:27 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
description:
Feb  4 06:04:14 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.187
description:
[2025-02-04 06:04:35 +0100] info [webmaild] 198.163.193.187 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
description:
Feb  4 06:03:43 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
description:
Feb  4 06:04:03 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-02-04 06:04:08 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:39864: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
description:
Feb  4 06:04:08 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.28
description:
Feb  4 06:04:21 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Feb  4 06:04:35 ait sshd[3934740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-02-04 06:04:20 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:53356: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
description:
2025-02-04 06:04:04 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:53388: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-02-04 06:04:02 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:37647: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
description:
Feb  4 06:04:05 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-02-04 06:04:06 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:33572: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Feb  4 06:04:11 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Feb  4 06:04:18 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-04 06:04:01 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:48729: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  4 06:03:59 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-02-04 06:04:04 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com [98.10.121.246]:45101: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
description:
2025-02-04 06:04:05 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:47528: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
description:
2025-02-04 06:04:10 dovecot_plain authenticator failed for ([27.40.100.131]) [27.40.100.131]:60761: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Feb  4 06:04:35 ait sshd[3934740]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Feb  4 06:04:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.145.123
description:
2025-02-04 06:04:35 dovecot_plain authenticator failed for ([61.191.145.123]) [61.191.145.123]:33373: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
description:
Feb  4 06:04:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
description:
2025-02-04 06:04:04 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:52554: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.243.64
description:
Feb  4 06:04:17 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.243.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.59.90.121
description:
Feb  4 06:04:17 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.59.90.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
description:
2025-02-04 06:04:17 dovecot_plain authenticator failed for ([148.102.73.4]) [148.102.76.10]:41114: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.134
description:
2025-02-04 06:04:04 dovecot_plain authenticator failed for ([27.45.233.134]) [27.45.233.134]:59044: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
description:
Feb  4 06:03:59 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Feb  4 06:04:01 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-02-04 06:04:06 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:49335: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Feb  4 06:04:27 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-02-04 06:04:16 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:53600: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-02-04 06:04:26 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:51805: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.20
description:
Feb  4 06:04:31 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 06:04:12 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:59563: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Feb  4 06:04:14 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.184.143.93
description:
2025-02-04 06:04:27 dovecot_plain authenticator failed for ([39.184.143.93]) [39.184.143.93]:43343: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
description:
Feb  4 06:04:00 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Feb  4 06:04:04 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.183.242
description:
2025-02-04 06:04:13 dovecot_plain authenticator failed for ([89.253.183.242]) [89.253.183.242]:40786: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-04 06:04:13 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:40517: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Feb  4 06:04:35 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
description:
Feb  4 06:04:14 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
description:
Feb  4 06:04:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
description:
2025-02-04 06:04:04 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:57754: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.37.17
description:
Feb  4 06:04:15 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.37.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.20
description:
2025-02-04 06:04:33 dovecot_plain authenticator failed for (201.218.181.20.viptel.com) [201.218.181.20]:41102: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Feb  4 06:04:04 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.183.242
description:
Feb  4 06:04:11 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.183.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
description:
Feb  4 06:04:15 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-02-04 06:04:34 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:58210: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
description:
Feb  4 06:04:20 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Feb  4 06:04:06 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
description:
2025-02-04 06:04:11 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:59170: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.2.203.254
description:
Feb  4 06:04:13 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.2.203.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
description:
2025-02-04 06:04:15 dovecot_plain authenticator failed for (hebei.2.60.in-addr.arpa) [60.2.203.254]:59519: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-02-04 06:05:18 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:38918: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.84.89
description:
Feb  4 06:05:21 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.84.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-04 06:05:33 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:45844: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-02-04 06:05:35 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:34786: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  4 06:04:48 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.139.139
description:
[2025-02-04 06:05:05 +0100] info [webmaild] 179.127.139.139 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Feb  4 06:05:16 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.91.84.89
description:
2025-02-04 06:05:23 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:41764: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-02-04 06:05:30 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:55563: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Feb  4 06:05:33 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-04 06:04:40 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:57276: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-04 06:04:50 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:57926: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.49.189.0
description:
[2025-02-04 06:05:01 +0100] info [webmaild] 189.49.189.0 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 06:05:14 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
description:
Feb  4 06:05:22 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
description:
2025-02-04 06:05:24 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:52528: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Feb  4 06:04:47 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-02-04 06:04:49 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:53067: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 06:05:23 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Feb  4 06:05:28 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  4 06:05:31 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.95.221.136
description:
[2025-02-04 06:05:35 +0100] info [webmaild] 200.95.221.136 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Feb  4 06:04:45 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-02-04 06:04:47 dovecot_plain authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:35038: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.242
description:
Feb  4 06:05:39 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.242
description:
2025-02-04 06:05:41 dovecot_plain authenticator failed for ([124.115.231.242]) [124.115.231.242]:51015: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
description:
2025-02-04 06:05:59 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:45326: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.114.171
description:
Feb  4 06:06:05 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.114.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
description:
Feb  4 06:06:15 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 06:06:05 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  4 06:06:15 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-04 06:06:17 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:52589: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-02-04 06:05:53 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:36864: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.205
description:
Feb  4 06:06:12 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 06:06:23 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.225
description:
Feb  4 06:05:42 ait sshd[3935344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.225 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 06:05:59 ait sshd[3935408]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Feb  4 06:06:12 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 06:06:25 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:47666: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Feb  4 06:06:33 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.204.130
description:
2025-02-04 06:06:14 dovecot_login authenticator failed for (XJ4LfemS) [58.27.204.130]:59459: 535 Incorrect authentication data (set_id=hagan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Feb  4 06:06:24 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 06:05:57 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.11.250.94
description:
Feb  4 06:05:58 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.11.250.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
description:
Feb  4 06:06:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
description:
2025-02-04 06:06:04 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:34868: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.27.204.130
description:
Feb  4 06:06:12 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.27.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.205
description:
2025-02-04 06:06:14 dovecot_plain authenticator failed for 111-70-25-205.emome-ip.hinet.net [111.70.25.205]:43718: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
description:
2025-02-04 06:06:17 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:55505: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-06.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
description:
Feb  4 06:05:45 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
description:
2025-02-04 06:05:47 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:40590: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Feb  4 06:05:51 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
description:
2025-02-04 06:06:07 dovecot_plain authenticator failed for ([2.55.114.171]) [2.55.114.171]:42882: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-04 06:06:26 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:36784: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
description:
2025-02-04 06:06:35 dovecot_plain authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:57418: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.225
description:
Feb  4 06:05:42 ait sshd[3935344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.225  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
description:
Feb  4 06:05:57 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 06:05:59 ait sshd[3935408]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.11.250.94
description:
2025-02-04 06:06:00 dovecot_plain authenticator failed for ([60.11.250.94]) [60.11.250.94]:44068: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-02-04 06:06:14 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:36226: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.97.29.113
description:
[2025-02-04 06:07:36 +0100] info [webmaild] 179.97.29.113 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.161.58
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS24A00072Y||WPU:ADS24A00072Y||RSV:6.65||T:APACHE||MV:06-06.45.61.161.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.104.79
description:
[2025-02-04 06:07:06 +0100] info [webmaild] 143.255.104.79 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-04 06:07:18 dovecot_login authenticator failed for ([103.171.59.125]) [103.171.59.125]:54594: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.27.204.130
description:
Feb  4 06:06:39 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.27.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-02-04 06:07:07 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:32721: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.204.130
description:
2025-02-04 06:06:41 dovecot_login authenticator failed for (GTQgQE7gDA) [58.27.204.130]:49406: 535 Incorrect authentication data (set_id=hagan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  4 06:07:16 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Feb  4 06:07:05 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.192.130
description:
[2025-02-04 06:07:37 +0100] info [webmaild] 45.183.192.130 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.204.130
description:
2025-02-04 06:08:13 dovecot_login authenticator failed for (sGpHLOt) [58.27.204.130]:58763: 535 Incorrect authentication data (set_id=hagan@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 207.180.230.127
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:willyguilkpase@yahoo.co.jp||WPU:willyguilkpase@yahoo.co.jp||RSV:6.65||T:APACHE||MV:06-07.207.180.230.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 06:08:08 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.27.204.130
description:
Feb  4 06:08:11 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.27.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.219
description:
Feb  4 06:07:45 ait sshd[3936092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.219  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.116.157
description:
[2025-02-04 06:08:10 +0100] info [webmaild] 138.97.116.157 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.66
description:
Feb  4 06:08:26 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.219
description:
Feb  4 06:07:45 ait sshd[3936092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.169
description:
Feb  4 06:08:38 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.66
description:
2025-02-04 06:08:28 dovecot_login authenticator failed for s142-59-214-66.ab.hsia.telus.net [142.59.214.66]:44889: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Feb  4 06:09:10 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
description:
Feb  4 06:09:24 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.38
description:
Feb  4 06:09:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.38
description:
2025-02-04 06:09:04 dovecot_plain authenticator failed for 111-70-6-38.emome-ip.hinet.net [111.70.6.38]:54284: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-02-04 06:09:17 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:55096: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-02-04 06:09:08 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:47674: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.152.161
description:
Feb  4 06:09:13 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Feb  4 06:09:29 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.250.7.67
description:
Feb  4 06:09:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.250.7.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Feb  4 06:09:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Feb  4 06:09:21 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-02-04 06:09:26 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:34380: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  4 06:09:15 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Feb  4 06:09:24 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
description:
2025-02-04 06:09:26 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:57335: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  4 06:09:36 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-04 06:09:19 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:51586: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  4 06:08:39 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-04 06:09:04 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:35972: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-02-04 06:09:12 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:52128: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.69.242.122
description:
Feb  4 06:09:17 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.69.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.69.242.122
description:
2025-02-04 06:09:19 dovecot_plain authenticator failed for ([101.69.242.122]) [101.69.242.122]:44214: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.36.155.187
description:
Feb  4 06:09:12 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.36.155.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Feb  4 06:09:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Feb  4 06:09:06 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-02-04 06:09:08 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:34028: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-04 06:09:15 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:34584: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  4 06:09:02 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.132.241
description:
Feb  4 06:09:08 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.132.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-02-04 06:09:21 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:51141: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  4 06:09:17 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.168.131.3
description:
2025-02-04 06:09:18 dovecot_plain authenticator failed for ([60.168.131.3]) [60.168.131.3]:43245: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
description:
Feb  4 06:09:01 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.168.131.3
description:
Feb  4 06:09:16 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.168.131.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
description:
2025-02-04 06:09:32 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:45614: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.169
description:
2025-02-04 06:08:40 dovecot_login authenticator failed for ([218.149.228.169]) [218.149.228.169]:52483: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-04 06:08:41 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (nulle) [83.233.242.245]:53304: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Feb  4 06:09:01 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-02-04 06:09:31 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:42152: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-02-04 06:09:23 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:55706: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-02-04 06:09:07 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:22705: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  4 06:09:13 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.36.155.187
description:
2025-02-04 06:09:14 dovecot_plain authenticator failed for ([136.36.155.187]) [136.36.155.187]:38252: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.152.161
description:
2025-02-04 06:09:15 dovecot_plain authenticator failed for (194.87.152.161-FTTB.planeta.tc) [194.87.152.161]:54360: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-02-04 06:09:04 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:33846: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.250.7.67
description:
2025-02-04 06:09:04 dovecot_plain authenticator failed for ([197.250.7.67]) [197.250.7.67]:60228: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.132.241
description:
2025-02-04 06:09:10 dovecot_plain authenticator failed for ([157.122.132.241]) [157.122.132.241]:41401: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
description:
Feb  4 06:09:30 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
description:
2025-02-04 06:09:03 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:34522: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-02-04 06:09:03 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:59590: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Feb  4 06:09:05 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Feb  4 06:09:06 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-04 06:09:49 dovecot_plain authenticator failed for (boncitions) [81.211.77.58]:62076: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Feb  4 06:10:34 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
description:
2025-02-04 06:09:46 dovecot_plain authenticator failed for (unrecomers) [65.20.253.152]:53352: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.20.6.2
description:
2025-02-04 06:09:48 dovecot_plain authenticator failed for (189-44-19-161.customer.tdatabrasil.net.br) [189.20.6.2]:41573: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
description:
2025-02-04 06:10:36 dovecot_login authenticator failed for ([116.116.156.198]) [116.116.156.198]:48197: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.134.250
description:
[2025-02-04 06:10:10 +0100] info [webmaild] 179.125.134.250 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  4 06:10:19 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-04 06:10:21 dovecot_login authenticator failed for ([121.202.154.173]) [121.202.154.173]:22646: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.241.153.15
description:
[2025-02-04 06:10:12 +0100] info [webmaild] 191.241.153.15 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-04 06:09:38 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:58477: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.205.129.146
description:
[2025-02-04 06:09:41 +0100] info [webmaild] 190.205.129.146 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.152
description:
Feb  4 06:09:44 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.6.2
description:
Feb  4 06:09:46 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.6.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  4 06:09:47 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.37
description:
[2025-02-04 06:10:43 +0100] info [webmaild] 213.230.87.37 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
description:
Feb  4 06:10:44 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Feb  4 06:10:46 ait auth[3925859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
description:
2025-02-04 06:10:46 dovecot_login authenticator failed for ([91.135.103.7]) [91.135.103.7]:34295: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-02-04 06:10:48 dovecot_login authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:43984: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.55.10
description:
47.128.55.10 - - [04/Feb/2025:06:11:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25349893 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/df239f?panel=form" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.55.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.148.10
description:
Feb  4 06:12:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.148.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
description:
2025-02-04 06:12:33 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:23190: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
description:
Feb  4 06:12:09 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.15.192.209
description:
[2025-02-04 06:12:13 +0100] info [webmaild] 196.15.192.209 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.6
description:
2025-02-04 06:12:16 dovecot_login authenticator failed for (ADMIN) [185.253.160.6]:53048: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.7.138
description:
Feb  4 06:12:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.97.7.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-02-04 06:12:29 dovecot_login authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:53220: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Feb  4 06:12:27 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
description:
2025-02-04 06:12:11 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:42294: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.247.90
description:
Feb  4 06:12:17 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.247.90
description:
2025-02-04 06:12:19 dovecot_login authenticator failed for ([36.154.247.90]) [36.154.247.90]:49394: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.7.138
description:
2025-02-04 06:12:23 dovecot_login authenticator failed for ([14.97.7.138]) [14.97.7.138]:60908: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
description:
Feb  4 06:12:58 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 06:12:51 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:40235: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Feb  4 06:13:05 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-02-04 06:12:40 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:38058: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.58.87
description:
[2025-02-04 06:12:41 +0100] info [webmaild] 45.70.58.87 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.85.183.88
description:
Feb  4 06:12:45 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.85.183.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
description:
2025-02-04 06:13:00 dovecot_login authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:65156: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-04 06:13:15 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:60056: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.220.136.110
description:
[2025-02-04 06:13:16 +0100] info [webmaild] 191.220.136.110 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.50.79
description:
[2025-02-04 06:12:41 +0100] info [webmaild] 187.19.50.79 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.85.183.88
description:
2025-02-04 06:12:47 dovecot_plain authenticator failed for a88.sub183.net78.udm.net (hopial) [78.85.183.88]:52358: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  4 06:13:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Feb  4 06:12:38 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 06:12:49 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-02-04 06:13:07 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:41360: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Feb  4 06:13:45 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-02-04 06:13:47 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com (cologic) [46.162.74.47]:51305: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Feb  4 06:13:57 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-02-04 06:13:59 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:49665: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Feb  4 06:14:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-02-04 06:14:09 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:48338: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.154.20.160
description:
[2025-02-04 06:15:16 +0100] info [webmaild] 179.154.20.160 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Feb  4 06:15:24 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-02-04 06:15:26 dovecot_login authenticator failed for ([200.223.193.9]) [200.223.192.254]:54211: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 23.175.192.206
description:
[2025-02-04 06:14:47 +0100] info [webmaild] 23.175.192.206 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.129.199
description:
Feb  4 06:15:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.129.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.129.199
description:
2025-02-04 06:15:08 dovecot_login authenticator failed for ([203.172.129.199]) [203.172.129.199]:53299: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.171.32
description:
[2025-02-04 06:15:14 +0100] info [webmaild] 138.94.171.32 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Feb  4 06:16:28 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Feb  4 06:16:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-02-04 06:16:30 dovecot_login authenticator failed for ([217.22.37.184]) [217.22.37.184]:58333: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-02-04 06:16:37 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:52283: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.161.68.114
description:
[2025-02-04 06:15:49 +0100] info [webmaild] 103.161.68.114 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.105.89.100
description:
2025-02-04 06:16:27 dovecot_plain authenticator failed for ([210.105.89.100]) [210.105.89.100]:33068: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.83.137.123
description:
[2025-02-04 06:17:16 +0100] info [webmaild] 95.83.137.123 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.166
description:
Feb  4 06:17:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-02-04 06:17:31 dovecot_plain authenticator failed for ([82.208.99.163]) [82.208.99.163]:49020: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
description:
2025-02-04 06:16:48 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:53929: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 06:17:17 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:59441: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Feb  4 06:17:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 06:17:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
description:
2025-02-04 06:17:36 dovecot_plain authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:64057: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
description:
Feb  4 06:16:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Feb  4 06:16:50 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Feb  4 06:17:29 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
description:
Feb  4 06:17:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 06:17:15 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.166
description:
2025-02-04 06:17:23 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:56210: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-02-04 06:17:37 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:58072: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-02-04 06:16:52 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:2352: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Feb  4 06:17:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.195.211.98
description:
Feb  4 06:17:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.195.211.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.59.144
description:
Feb  4 06:17:49 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.59.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.178.109.220
description:
[2025-02-04 06:18:28 +0100] info [webmaild] 186.178.109.220 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Feb  4 06:18:36 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.240.59.213
description:
[2025-02-04 06:17:46 +0100] info [webmaild] 197.240.59.213 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.108.22.238
description:
[2025-02-04 06:17:48 +0100] info [webmaild] 185.108.22.238 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.59.144
description:
2025-02-04 06:17:51 dovecot_plain authenticator failed for ([222.116.59.144]) [222.116.59.144]:42296: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-02-04 06:17:54 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:57608: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Feb  4 06:18:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-02-04 06:18:38 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:40883: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-02-04 06:17:39 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:60346: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
description:
2025-02-04 06:17:44 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:43273: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
description:
2025-02-04 06:17:45 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (liallity) [73.195.211.98]:40388: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Feb  4 06:17:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-02-04 06:18:21 dovecot_login authenticator failed for ([222.106.198.35]) [222.106.198.35]:34874: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
description:
Feb  4 06:17:42 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.17.203
description:
47.128.17.203 - - [04/Feb/2025:06:18:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10280505 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?duration=short%2Cmedium&filter_course-category=30&filtering=1&instructor=2&level=intermediate%2Call_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Feb  4 06:18:59 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-02-04 06:19:12 dovecot_login authenticator failed for ([219.91.172.21]) [219.91.172.21]:49194: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Feb  4 06:18:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-02-04 06:19:01 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:56282: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-02-04 06:18:58 dovecot_plain authenticator failed for (czamy) [62.182.116.64]:51550: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Feb  4 06:19:10 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
description:
Feb  4 06:20:03 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
description:
2025-02-04 06:20:05 dovecot_login authenticator failed for ([196.189.126.185]) [196.189.126.185]:34856: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-04 06:20:08 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.157.111]:38978: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-02-04 06:20:15 dovecot_login authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:46454: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.101.204.242
description:
2025-02-04 06:20:33 dovecot_plain authenticator failed for ([112.101.204.242]) [112.101.204.242]:59627: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.92
description:
47.128.50.92 - - [04/Feb/2025:06:19:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8561147 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205&filter_course-language=79%2C120%2C118%2C95%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
description:
Feb  4 06:19:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.233.5.4
description:
[2025-02-04 06:19:52 +0100] info [webmaild] 88.233.5.4 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-20.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
description:
2025-02-04 06:19:54 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:44859: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Feb  4 06:19:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  4 06:20:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
description:
Feb  4 06:20:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-02-04 06:19:58 dovecot_login authenticator failed for ([178.178.222.58]) [178.178.222.58]:47042: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.98.44
description:
2025-02-04 06:20:23 dovecot_login authenticator failed for (31094-49731.bacloud.info.) [122.170.98.44]:54593: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.101.204.242
description:
Feb  4 06:20:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.101.204.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.185.82
description:
[2025-02-04 06:20:22 +0100] info [webmaild] 45.181.185.82 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.129.10.175
description:
[2025-02-04 06:20:22 +0100] info [webmaild] 94.129.10.175 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.228.203.168
description:
Feb  4 06:20:48 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.228.203.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Feb  4 06:20:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.24.45.150
description:
2025-02-04 06:21:28 dovecot_plain authenticator failed for ([192.24.45.150]) [192.24.45.150]:58538: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
description:
2025-02-04 06:20:54 dovecot_login authenticator failed for ([45.179.144.38]) [45.179.144.38]:54778: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  4 06:20:40 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-04 06:20:42 dovecot_login authenticator failed for ([177.43.106.73]) [177.43.106.73]:50969: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.123.153
description:
2025-02-04 06:20:48 dovecot_login authenticator failed for ([24.224.123.153]) [24.224.123.153]:48831: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.228.203.168
description:
2025-02-04 06:20:50 dovecot_login authenticator failed for (ait.edu.gh) [37.228.203.168]:56859: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.24.45.150
description:
Feb  4 06:21:26 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.24.45.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.224.123.153
description:
Feb  4 06:20:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.224.123.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
description:
Feb  4 06:20:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.22.94.194
description:
[2025-02-04 06:20:54 +0100] info [webmaild] 187.22.94.194 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-04 06:20:56 dovecot_login authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:59682: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.111
description:
[2025-02-04 06:22:11 +0100] info [cpaneld] 104.207.48.111 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Feb  4 06:22:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.70
description:
[2025-02-04 06:22:18 +0100] info [whostmgrd] 156.228.94.70 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.96.11.230
description:
2025-02-04 06:22:30 dovecot_login authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:59800: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.100.19.218
description:
[2025-02-04 06:22:31 +0100] info [webmaild] 191.100.19.218 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.113.174.95
description:
Feb  4 06:22:11 ait sshd[3941128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.113.174.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.186
description:
[2025-02-04 06:22:11 +0100] info [cpaneld] 104.207.63.186 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-02-04 06:21:43 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:34796: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.69
description:
[2025-02-04 06:22:18 +0100] info [whostmgrd] 156.228.114.69 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.89
description:
[2025-02-04 06:22:18 +0100] info [whostmgrd] 104.207.49.89 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Feb  4 06:21:41 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.113.174.95
description:
Feb  4 06:22:11 ait sshd[3941128]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.113.174.95 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.108.219
description:
[2025-02-04 06:22:10 +0100] info [cpaneld] 156.228.108.219 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.203
description:
[2025-02-04 06:22:12 +0100] info [whostmgrd] 156.228.87.203 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.31
description:
[2025-02-04 06:22:12 +0100] info [whostmgrd] 104.207.35.31 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.144
description:
[2025-02-04 06:22:10 +0100] info [cpaneld] 156.228.99.144 - botchway "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user botchway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.44.179
description:
[2025-02-04 06:22:10 +0100] info [cpaneld] 104.207.44.179 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-02-04 06:22:15 dovecot_login authenticator failed for ([103.180.240.96]) [103.180.240.96]:46904: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.96.11.230
description:
Feb  4 06:22:28 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.96.11.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 06:22:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Feb  4 06:23:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-04 06:23:20 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:38840: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-02-04 06:23:22 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:47479: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 06:23:23 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.162.229.187
description:
[2025-02-04 06:23:02 +0100] info [webmaild] 188.162.229.187 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-02-04 06:23:09 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:60772: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Feb  4 06:23:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Feb  4 06:23:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.112.158
description:
[2025-02-04 06:22:54 +0100] info [webmaild] 186.233.112.158 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  4 06:23:18 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.41.211
description:
47.128.41.211 - - [04/Feb/2025:06:23:05 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17354005" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-02-04 06:23:22 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:23966: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.101.121.53
description:
[2025-02-04 06:23:27 +0100] info [webmaild] 186.101.121.53 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-04 06:23:54 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:50066: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.112.194.160
description:
Feb  4 06:24:01 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.112.194.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.220
description:
Feb  4 06:24:29 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
description:
Feb  4 06:23:50 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
description:
2025-02-04 06:23:59 dovecot_plain authenticator failed for ([60.174.40.155]) [60.174.40.155]:46704: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Feb  4 06:23:50 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.177.209.66
description:
Feb  4 06:23:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.177.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.102
description:
2025-02-04 06:23:53 dovecot_plain authenticator failed for ([102.69.163.102]) [102.69.163.102]:35098: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Feb  4 06:24:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 06:23:44 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Feb  4 06:23:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.245.222.217
description:
Feb  4 06:24:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.245.222.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
description:
Feb  4 06:23:48 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  4 06:24:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Feb  4 06:23:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-02-04 06:23:54 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:33562: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 06:24:15 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Feb  4 06:23:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-02-04 06:23:52 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:54119: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
description:
Feb  4 06:23:57 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-02-04 06:23:57 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:53920: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-02-04 06:24:06 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:48956: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.134.232
description:
Feb  4 06:24:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
description:
Feb  4 06:24:08 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.249.36.3
description:
Feb  4 06:23:57 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.249.36.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.71.238
description:
2025-02-04 06:24:06 dovecot_plain authenticator failed for (c-50-187-71-238.unallocated.comcastbusiness.net) [50.187.71.238]:34284: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
description:
2025-02-04 06:24:37 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:26867: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-02-04 06:23:53 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:37390: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.187.71.238
description:
Feb  4 06:24:04 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.187.71.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  4 06:24:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Feb  4 06:24:09 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-02-04 06:24:19 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:54052: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
description:
Feb  4 06:24:23 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
description:
Feb  4 06:24:24 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-02-04 06:24:25 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:54242: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Feb  4 06:23:51 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-02-04 06:23:51 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:33927: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.177.209.66
description:
2025-02-04 06:23:54 dovecot_plain authenticator failed for ([42.177.209.66]) [42.177.209.66]:53259: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Feb  4 06:23:57 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-02-04 06:24:07 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:58032: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 167.99.52.233
domain: mail.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:06-24.167.99.52.233||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.134.232
description:
2025-02-04 06:24:09 dovecot_plain authenticator failed for ([151.3.134.232]) [151.3.134.232]:34351: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.241
description:
Feb  4 06:24:38 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 167.99.52.233
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ait02/public_html/wp-admin/images/index.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Feb  4 06:23:51 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-02-04 06:24:00 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:44858: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-02-04 06:23:59 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:50928: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
description:
2025-02-04 06:24:22 dovecot_plain authenticator failed for ([191.217.137.126]) [191.217.137.126]:43005: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-02-04 06:24:26 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:42275: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Feb  4 06:23:50 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.149.21
description:
Feb  4 06:24:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.149.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.220
description:
2025-02-04 06:24:31 dovecot_plain authenticator failed for p87221-obmd01.osaka.ocn.ne.jp [180.7.158.220]:45446: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-02-04 06:23:48 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:55421: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
description:
2025-02-04 06:23:52 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:45268: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.249.36.3
description:
2025-02-04 06:23:59 dovecot_plain authenticator failed for ([183.71.251.66]) [113.249.36.3]:18528: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Feb  4 06:24:17 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Feb  4 06:23:49 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.102
description:
Feb  4 06:23:51 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Feb  4 06:24:30 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Feb  4 06:23:58 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-04 06:24:09 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:47014: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-02-04 06:24:11 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:34680: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  4 06:24:34 ait sshd[3942997]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.185
description:
2025-02-04 06:24:06 dovecot_plain authenticator failed for ([220.180.171.185]) [220.180.171.185]:37217: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Feb  4 06:24:08 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
description:
2025-02-04 06:24:10 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:46908: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  4 06:24:22 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Feb  4 06:24:25 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-02-04 06:23:54 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:52482: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.112.194.160
description:
2025-02-04 06:24:03 dovecot_plain authenticator failed for ([106.112.194.160]) [106.112.194.160]:60894: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
description:
Feb  4 06:24:05 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.95.230.95
description:
2025-02-04 06:24:26 dovecot_plain authenticator failed for ([210.95.230.95]) [210.95.230.95]:40996: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Feb  4 06:24:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-02-04 06:23:52 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:42899: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Feb  4 06:23:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Feb  4 06:24:04 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-02-04 06:24:32 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:45540: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 06:23:46 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:51044: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  4 06:24:03 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-02-04 06:24:05 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:56877: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.21
description:
2025-02-04 06:24:15 dovecot_plain authenticator failed for ([49.124.149.21]) [49.124.149.21]:59058: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Feb  4 06:23:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
description:
2025-02-04 06:23:50 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:59206: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.245.222.217
description:
2025-02-04 06:24:08 dovecot_plain authenticator failed for ([211.245.222.217]) [211.245.222.217]:49833: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 06:23:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
description:
Feb  4 06:24:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-04 06:24:27 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:61199: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-04 06:24:07 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:38708: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-02-04 06:24:08 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:53660: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-02-04 06:23:48 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:32288: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  4 06:23:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-02-04 06:23:53 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:59142: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-02-04 06:24:10 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:42920: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-02-04 06:24:37 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:51668: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.74.187
description:
Feb  4 06:24:08 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.74.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  4 06:24:05 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-04 06:24:15 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:58670: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-02-04 06:24:24 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:45172: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
description:
Feb  4 06:24:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 06:23:55 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:41709: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.185
description:
Feb  4 06:24:04 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
description:
2025-02-04 06:24:10 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:58178: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 06:24:34 ait sshd[3942997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-04 06:24:49 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:29174: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-02-04 06:24:52 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:27955: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Feb  4 06:25:17 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Feb  4 06:25:32 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-02-04 06:24:46 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:51760: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
description:
Feb  4 06:24:58 ait sshd[3943298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  4 06:24:58 ait sshd[3943298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-02-04 06:25:34 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:52664: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.241
description:
2025-02-04 06:24:40 dovecot_plain authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:48740: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.110.120.96
description:
Feb  4 06:25:15 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.110.120.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.129.110
description:
Feb  4 06:25:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.129.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Feb  4 06:24:44 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  4 06:24:47 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.48.27
description:
Feb  4 06:24:48 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.48.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.48.27
description:
2025-02-04 06:24:50 dovecot_plain authenticator failed for 111-70-48-27.emome-ip.hinet.net [111.70.48.27]:48498: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.118.173.234
description:
Feb  4 06:24:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.118.173.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-02-04 06:25:01 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:30748: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
description:
2025-02-04 06:25:05 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:51774: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.110.120.96
description:
2025-02-04 06:25:17 dovecot_plain authenticator failed for ([189.110.120.96]) [189.110.120.96]:59762: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
description:
Feb  4 06:24:39 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.129.110
description:
2025-02-04 06:25:21 dovecot_plain authenticator failed for (abts-mum-static-110.129.179.122.airtelbroadband.in) [122.179.129.110]:36271: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
description:
Feb  4 06:25:30 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-02-04 06:25:19 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:33944: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
description:
2025-02-04 06:24:53 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:42936: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.210.61.208
description:
Feb  4 06:25:03 ait sshd[3943454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.210.61.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-02-04 06:25:10 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:49536: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.173.234
description:
2025-02-04 06:24:55 dovecot_plain authenticator failed for ([220.118.173.234]) [220.118.173.234]:46158: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
description:
Feb  4 06:24:51 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Feb  4 06:24:59 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.210.61.208
description:
Feb  4 06:25:03 ait sshd[3943454]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.210.61.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.36.198.254
description:
[2025-02-04 06:25:09 +0100] info [webmaild] 5.36.198.254 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
description:
2025-02-04 06:24:41 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:6185: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Feb  4 06:25:08 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 06:25:23 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.241.41
description:
[2025-02-04 06:25:29 +0100] info [webmaild] 177.234.241.41 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
description:
2025-02-04 06:25:32 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:35068: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Feb  4 06:24:50 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.18.129.238
description:
Feb  4 06:25:49 ait sshd[3943735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.18.129.238  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-02-04 06:25:57 dovecot_plain authenticator failed for ([14.45.217.249]) [14.45.217.249]:37232: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-02-04 06:25:58 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:54464: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.21.113
description:
2025-02-04 06:26:12 dovecot_plain authenticator failed for ([117.158.21.113]) [117.158.21.113]:56173: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
description:
2025-02-04 06:26:36 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:53603: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.84.132
description:
[2025-02-04 06:25:39 +0100] info [webmaild] 179.48.84.132 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
description:
Feb  4 06:25:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.90.230
description:
[2025-02-04 06:26:04 +0100] info [webmaild] 37.40.90.230 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.21.113
description:
Feb  4 06:26:10 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.21.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.228.190.124
description:
Feb  4 06:26:12 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.228.190.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
description:
2025-02-04 06:26:14 dovecot_login authenticator failed for 45-228-190-124.obercom.net.ar [45.228.190.124]:43280: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Feb  4 06:26:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-02-04 06:26:22 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:42082: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.33.218.186
description:
Feb  4 06:26:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.33.218.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.18.129.238
description:
Feb  4 06:25:49 ait sshd[3943735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.18.129.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Feb  4 06:25:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Feb  4 06:27:02 ait sshd[3944038]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.15.104
description:
2025-02-04 06:27:18 dovecot_plain authenticator failed for 95-31-15-104.static.corbina.ru [95.31.15.104]:50301: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-02-04 06:27:23 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:33757: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
description:
2025-02-04 06:27:23 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:10143: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.156.255.186
description:
Feb  4 06:27:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.156.255.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-04 06:27:36 dovecot_plain authenticator failed for ([177.174.85.129]) [177.174.85.137]:34273: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.210.61.208
description:
Feb  4 06:27:08 ait sshd[3944211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.210.61.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-02-04 06:27:34 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:28584: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.44.79.69
description:
Feb  4 06:27:15 ait sshd[3944245]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.44.79.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-02-04 06:27:20 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:48532: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-04 06:27:21 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:55143: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.139.195
description:
2025-02-04 06:27:34 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:57032: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
description:
Feb  4 06:27:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.235.199
description:
Feb  4 06:27:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.235.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.97.166.63
description:
Feb  4 06:26:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.97.166.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-02-04 06:27:01 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:44361: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.76
description:
2025-02-04 06:27:15 dovecot_login authenticator failed for ([183.204.41.76]) [183.204.41.76]:60196: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
description:
Feb  4 06:27:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  4 06:27:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-02-04 06:27:37 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:13056: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Feb  4 06:27:02 ait sshd[3944038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.44.79.69
description:
Feb  4 06:27:15 ait sshd[3944245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.44.79.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.15.104
description:
Feb  4 06:27:16 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Feb  4 06:27:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-02-04 06:27:25 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:44465: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
description:
2025-02-04 06:27:36 dovecot_plain authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:46883: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.133.6
description:
Feb  4 06:27:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.133.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.210.61.208
description:
Feb  4 06:27:08 ait sshd[3944211]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.210.61.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
description:
Feb  4 06:27:22 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
description:
2025-02-04 06:27:24 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:34572: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Feb  4 06:27:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.18.129.238
description:
Feb  4 06:27:37 ait sshd[3944422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.18.129.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.235.199
description:
2025-02-04 06:27:37 dovecot_plain authenticator failed for ([27.45.235.199]) [27.45.235.199]:37679: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  4 06:27:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Feb  4 06:27:18 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.113.174.95
description:
Feb  4 06:27:27 ait sshd[3944406]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.113.174.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
description:
Feb  4 06:27:32 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.18.129.238
description:
Feb  4 06:27:37 ait sshd[3944422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.18.129.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.156.255.186
description:
2025-02-04 06:27:37 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:47204: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.97.166.63
description:
2025-02-04 06:26:58 dovecot_login authenticator failed for 172-97-166-63.cpe.distributel.net [172.97.166.63]:62980: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.76
description:
Feb  4 06:27:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.139.195
description:
Feb  4 06:27:32 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.139.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-04 06:27:36 dovecot_login authenticator failed for ([171.244.142.135]) [171.244.142.135]:59914: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Feb  4 06:26:59 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
description:
Feb  4 06:27:23 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.113.174.95
description:
Feb  4 06:27:27 ait sshd[3944406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.113.174.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  4 06:27:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.10.27.190
description:
Feb  4 06:27:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.10.27.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.206.105.37
description:
Feb  4 06:28:36 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.206.105.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.210.61.208
description:
Feb  4 06:28:35 ait sshd[3944892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.210.61.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.206.105.37
description:
2025-02-04 06:28:38 dovecot_plain authenticator failed for ([10.13.105.93]) [195.206.105.37]:60438: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.183.247
description:
Feb  4 06:27:38 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.183.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-02-04 06:28:21 dovecot_plain authenticator failed for ([218.22.253.37]) [218.22.253.37]:32835: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
description:
Feb  4 06:28:36 ait sshd[3944892]: Failed password for invalid user debian from 35.210.61.208 port 58146 ssh2


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.18.129.238
description:
Feb  4 06:27:39 ait sshd[3944422]: Failed password for invalid user odoo15 from 192.18.129.238 port 53234 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
description:
2025-02-04 06:27:39 dovecot_plain authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:42796: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.183.247
description:
2025-02-04 06:27:40 dovecot_plain authenticator failed for ([207.188.183.247]) [207.188.183.247]:34234: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
description:
Feb  4 06:28:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Feb  4 06:28:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
description:
2025-02-04 06:27:54 dovecot_login authenticator failed for ([211.243.43.58]) [211.243.43.58]:50314: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.230.219.17
description:
[2025-02-04 06:28:10 +0100] info [webmaild] 38.230.219.17 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-02-04 06:28:33 dovecot_plain authenticator failed for ([122.187.243.95]) [122.187.243.95]:60149: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-02-04 06:27:43 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:40926: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
description:
Feb  4 06:27:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.10.27.190
description:
2025-02-04 06:27:58 dovecot_plain authenticator failed for ([218.10.27.190]) [218.10.27.190]:60734: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.29.14
description:
[2025-02-04 06:28:09 +0100] info [webmaild] 170.239.29.14 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.80.16.76
description:
[2025-02-04 06:27:42 +0100] info [webmaild] 181.80.16.76 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-02-04 06:27:57 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:45826: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.210.61.208
description:
Feb  4 06:28:35 ait sshd[3944892]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.210.61.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Feb  4 06:27:41 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Feb  4 06:27:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Feb  4 06:27:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-02-04 06:27:55 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:37704: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.206.105.37
description:
Feb  4 06:28:42 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.206.105.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.18.129.238
description:
Feb  4 06:28:55 ait sshd[3945015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.18.129.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Feb  4 06:29:09 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Feb  4 06:29:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-02-04 06:29:22 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:34652: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.77.71
description:
[2025-02-04 06:28:42 +0100] info [webmaild] 177.200.77.71 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.113.174.95
description:
Feb  4 06:29:03 ait sshd[3945069]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.113.174.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.113.174.95
description:
Feb  4 06:29:03 ait sshd[3945069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.113.174.95


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.44.79.69
description:
Feb  4 06:29:24 ait sshd[3945133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.44.79.69


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.18.129.238
description:
Feb  4 06:28:55 ait sshd[3945015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.18.129.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.44.79.69
description:
Feb  4 06:29:24 ait sshd[3945133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.44.79.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.206.105.37
description:
2025-02-04 06:28:44 dovecot_login authenticator failed for ([10.13.105.93]) [195.206.105.37]:60438: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-02-04 06:29:11 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:39532: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.87.122.207
description:
2025-02-04 06:30:31 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:51478: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-04 06:29:57 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:42226: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.167.55
description:
[2025-02-04 06:30:20 +0100] info [webmaild] 90.156.167.55 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  4 06:30:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-02-04 06:30:08 dovecot_login authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:35540: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  4 06:29:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.44.79.69
description:
Feb  4 06:30:22 ait sshd[3945524]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.44.79.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.44.79.69
description:
Feb  4 06:30:22 ait sshd[3945524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.44.79.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.87.122.207
description:
Feb  4 06:30:29 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.87.122.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 06:30:00 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.117.197.238
description:
Feb  4 06:30:18 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.117.197.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.117.197.238
description:
2025-02-04 06:30:20 dovecot_plain authenticator failed for net-109-117-197-238.cust.vodafonedsl.it [109.117.197.238]:50662: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-02-04 06:30:55 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:42245: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.77.135
description:
[2025-02-04 06:31:22 +0100] info [webmaild] 45.228.77.135 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.127.7.240
description:
[2025-02-04 06:30:51 +0100] info [webmaild] 103.127.7.240 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
description:
2025-02-04 06:31:30 dovecot_login authenticator failed for ([183.98.215.147]) [183.98.215.147]:7179: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.46.88.186
description:
2025-02-04 06:30:45 dovecot_plain authenticator failed for ([115.46.88.186]) [115.46.88.186]:38511: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
description:
Feb  4 06:30:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
description:
Feb  4 06:31:28 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.26.246.134
description:
[2025-02-04 06:30:48 +0100] info [webmaild] 103.26.246.134 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.46.88.186
description:
Feb  4 06:30:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.46.88.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
description:
Feb  4 06:31:44 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
description:
2025-02-04 06:31:46 dovecot_login authenticator failed for ([170.81.14.113]) [170.81.14.113]:40218: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.205.117.101
description:
[2025-02-04 06:33:16 +0100] info [webmaild] 176.205.117.101 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
description:
Feb  4 06:33:26 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
description:
2025-02-04 06:33:28 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:55402: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Feb  4 06:32:39 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.94.49
description:
[2025-02-04 06:32:46 +0100] info [webmaild] 179.108.94.49 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-02-04 06:32:57 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:46994: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
description:
2025-02-04 06:33:00 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:50982: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.207.132.29
description:
2025-02-04 06:32:53 dovecot_plain authenticator failed for ([218.207.132.29]) [218.207.132.29]:39929: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
description:
2025-02-04 06:33:13 dovecot_login authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:38362: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
description:
Feb  4 06:33:14 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.216
description:
Feb  4 06:33:32 ait sshd[3946695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.207.132.29
description:
Feb  4 06:32:51 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.207.132.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Feb  4 06:32:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.199.245
description:
Feb  4 06:32:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.199.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
description:
Feb  4 06:32:58 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.123
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ENG15B00223Y||WPU:ENG15B00223Y||RSV:6.65||T:APACHE||MV:06-33.170.205.31.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-02-04 06:32:41 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:43448: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.199.245
description:
2025-02-04 06:32:45 dovecot_plain authenticator failed for 5.185.199.245.ipv4.public.orange.pl (chilly) [5.185.199.245]:41916: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.204.87.72
description:
[2025-02-04 06:33:22 +0100] info [webmaild] 213.204.87.72 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
description:
2025-02-04 06:33:16 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:49146: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.216
description:
Feb  4 06:33:32 ait sshd[3946695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.216  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
description:
Feb  4 06:33:11 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.216
description:
Feb  4 06:33:40 ait sshd[3946695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.104.28.180
description:
[2025-02-04 06:33:57 +0100] info [webmaild] 103.104.28.180 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-02-04 06:34:30 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:45070: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Feb  4 06:34:28 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  4 06:33:41 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  4 06:34:18 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-04 06:34:20 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:35991: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-04 06:33:43 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:32780: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.216
description:
Feb  4 06:33:46 ait sshd[3946749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.216  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Feb  4 06:34:38 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Feb  4 06:35:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.33.31
description:
[2025-02-04 06:35:15 +0100] info [webmaild] 45.190.33.31 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-35.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 06:35:12 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-04 06:35:23 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:38448: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-02-04 06:34:40 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:44377: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 06:35:14 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:42964: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.88.146
description:
2025-02-04 06:34:48 dovecot_plain authenticator failed for ([58.18.88.146]) [58.18.88.146]:58541: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Feb  4 06:35:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-02-04 06:35:22 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-165.hinet-ip.hinet.net) [61.216.7.163]:42163: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.88.146
description:
Feb  4 06:34:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.88.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.23.60.172
description:
[2025-02-04 06:36:32 +0100] info [webmaild] 177.23.60.172 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.161.98.179
description:
Feb  4 06:36:39 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.161.98.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
description:
2025-02-04 06:35:57 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:61648: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.234
description:
Feb  4 06:35:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.133.94.122
description:
[2025-02-04 06:35:59 +0100] info [webmaild] 2.133.94.122 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Feb  4 06:35:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.55.80.53
description:
[2025-02-04 06:35:46 +0100] info [webmaild] 191.55.80.53 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-02-04 06:35:47 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:41974: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-02-04 06:36:19 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:34852: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Feb  4 06:36:17 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
description:
Feb  4 06:35:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-02-04 06:35:45 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:35675: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Feb  4 06:35:45 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.234
description:
2025-02-04 06:35:55 dovecot_plain authenticator failed for (inisci) [65.20.169.234]:45418: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-02-04 06:38:08 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:38988: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
description:
2025-02-04 06:38:11 dovecot_plain authenticator failed for ([85.12.240.14]) [85.12.240.14]:36920: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
description:
2025-02-04 06:38:21 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:51610: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
description:
2025-02-04 06:38:31 dovecot_plain authenticator failed for ([195.158.19.6]) [195.158.19.6]:40428: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.209.48
description:
Feb  4 06:37:38 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.209.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.167.115.17
description:
2025-02-04 06:37:56 dovecot_plain authenticator failed for (173-167-115-17-sfba.hfc.comcastbusiness.net) [173.167.115.17]:53006: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-02-04 06:38:03 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:44181: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.12.240.14
description:
Feb  4 06:38:09 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.12.240.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  4 06:37:58 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.0.129.89
description:
[2025-02-04 06:38:01 +0100] info [webmaild] 186.0.129.89 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Feb  4 06:38:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.33.44.158
description:
Feb  4 06:38:10 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.33.44.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
description:
2025-02-04 06:38:16 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:44079: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
description:
Feb  4 06:38:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Feb  4 06:37:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Feb  4 06:37:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
description:
2025-02-04 06:37:56 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:40838: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-04 06:38:00 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:36865: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-02-04 06:38:06 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:57482: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
description:
Feb  4 06:38:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-02-04 06:37:54 dovecot_plain authenticator failed for ([185.232.39.165]) [185.232.39.165]:43636: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-02-04 06:37:59 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:36044: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Feb  4 06:38:04 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
description:
Feb  4 06:38:14 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.40
description:
47.128.122.40 - - [04/Feb/2025:06:37:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11222186 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/6/?duration=medium&filter_course-language=183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.33.44.158
description:
2025-02-04 06:38:12 dovecot_plain authenticator failed for ([89.33.44.158]) [89.33.44.158]:52260: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-02-04 06:38:18 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:48412: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.215.31.124
description:
Feb  4 06:37:48 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.215.31.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
description:
2025-02-04 06:37:45 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:50824: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-02-04 06:37:54 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:54380: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Feb  4 06:37:57 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.215.31.124
description:
2025-02-04 06:37:50 dovecot_plain authenticator failed for ([47.215.31.124]) [47.215.31.124]:48544: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.13.99.66
description:
Feb  4 06:37:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.13.99.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Feb  4 06:38:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
description:
2025-02-04 06:38:22 dovecot_plain authenticator failed for (23-94-85-164-host.colocrossing.com) [23.94.85.164]:35866: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
description:
Feb  4 06:37:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.20.166
description:
2025-02-04 06:37:58 dovecot_plain authenticator failed for 111-70-20-166.emome-ip.hinet.net [111.70.20.166]:39971: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.20.166
description:
Feb  4 06:37:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 06:38:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
description:
2025-02-04 06:38:11 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:58931: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
description:
Feb  4 06:37:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
description:
Feb  4 06:38:01 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
description:
2025-02-04 06:38:03 dovecot_plain authenticator failed for ([113.108.88.121]) [113.108.88.121]:60628: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
description:
Feb  4 06:38:09 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Feb  4 06:38:16 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 161.22.34.37
description:
[2025-02-04 06:38:30 +0100] info [webmaild] 161.22.34.37 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.167.115.17
description:
Feb  4 06:37:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.167.115.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
description:
2025-02-04 06:37:56 dovecot_plain authenticator failed for ([210.13.99.68]) [210.13.99.66]:30967: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Feb  4 06:38:01 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-02-04 06:38:09 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:47894: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
description:
2025-02-04 06:37:40 dovecot_plain authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:58744: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
description:
Feb  4 06:38:29 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.122.245
description:
Feb  4 06:39:02 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.122.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
description:
2025-02-04 06:39:04 dovecot_plain authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:43885: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.63.40.200
description:
[2025-02-04 06:38:37 +0100] info [webmaild] 189.63.40.200 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
description:
2025-02-04 06:38:43 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:36826: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-02-04 06:38:55 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-165.hinet-ip.hinet.net) [61.216.7.163]:53073: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Feb  4 06:38:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.6.185.28
description:
Feb  4 06:39:17 ait sshd[3948883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.6.185.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Feb  4 06:38:57 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-02-04 06:38:59 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:49070: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.101.151
description:
[2025-02-04 06:39:13 +0100] info [webmaild] 138.219.101.151 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-02-04 06:38:39 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:50293: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
description:
Feb  4 06:38:41 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Feb  4 06:38:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
description:
2025-02-04 06:39:22 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:45585: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
description:
Feb  4 06:39:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
description:
2025-02-04 06:39:33 dovecot_login authenticator failed for ([151.252.197.3]) [151.252.197.3]:32852: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.185.28
description:
Feb  4 06:39:17 ait sshd[3948883]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.6.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
description:
Feb  4 06:39:20 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.78
description:
2025-02-04 06:40:28 dovecot_plain authenticator failed for ([39.152.196.78]) [39.152.196.78]:59919: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.152.55
description:
[2025-02-04 06:40:32 +0100] info [webmaild] 177.124.152.55 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Feb  4 06:40:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
description:
2025-02-04 06:40:23 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:47820: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.78
description:
Feb  4 06:40:26 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.116
description:
Feb  4 06:40:27 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.3.72
description:
2025-02-04 06:40:36 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:53538: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
description:
Feb  4 06:40:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
description:
Feb  4 06:39:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.199.89
description:
Feb  4 06:40:01 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.199.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-02-04 06:40:08 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:59749: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
description:
Feb  4 06:40:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.3.72
description:
Feb  4 06:40:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.3.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-02-04 06:39:39 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:57312: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.199.89
description:
2025-02-04 06:40:03 dovecot_plain authenticator failed for ([112.102.199.89]) [112.102.199.89]:59655: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Feb  4 06:40:16 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-02-04 06:40:18 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:53782: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.116
description:
2025-02-04 06:40:29 dovecot_plain authenticator failed for st7028.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.116]:48492: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.18.28
description:
[2025-02-04 06:41:02 +0100] info [webmaild] 191.99.18.28 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.251.185
description:
[2025-02-04 06:41:05 +0100] info [webmaild] 177.234.251.185 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-02-04 06:41:34 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:34231: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.229.86.61
description:
[2025-02-04 06:41:37 +0100] info [webmaild] 103.229.86.61 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Feb  4 06:40:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
description:
Feb  4 06:41:09 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
description:
2025-02-04 06:41:11 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.149.57]:50737: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-02-04 06:41:21 dovecot_login authenticator failed for ([120.224.15.67]) [120.224.15.67]:59436: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
description:
2025-02-04 06:40:39 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:46805: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-02-04 06:40:45 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:37388: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Feb  4 06:41:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Feb  4 06:41:32 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.39.166
description:
2025-02-04 06:41:49 dovecot_plain authenticator failed for ([60.28.39.166]) [60.28.39.166]:33878: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
description:
Feb  4 06:41:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
description:
2025-02-04 06:41:58 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:60198: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Feb  4 06:41:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-02-04 06:41:45 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:17766: 535 Incorrect authentication data (set_id=mumuni)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 87.120.125.158
domain: afaccra.u3l.us
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.39.166
description:
Feb  4 06:41:47 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.39.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.209.73.198
description:
[2025-02-04 06:43:05 +0100] info [webmaild] 181.209.73.198 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.110.7
description:
[2025-02-04 06:43:33 +0100] info [webmaild] 138.186.110.7 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.13.145.118
description:
Feb  4 06:43:07 ait sshd[3950361]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.13.145.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.13.145.118
description:
Feb  4 06:43:07 ait sshd[3950361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.13.145.118


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.18.214.114
description:
[2025-02-04 06:43:35 +0100] info [webmaild] 5.18.214.114 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.76.238
description:
[2025-02-04 06:44:09 +0100] info [webmaild] 213.230.76.238 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
description:
2025-02-04 06:44:23 dovecot_plain authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:40382: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Feb  4 06:44:32 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-04 06:44:34 dovecot_plain authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:38280: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
description:
2025-02-04 06:44:03 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:55730: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  4 06:44:32 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
description:
Feb  4 06:44:01 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-02-04 06:44:34 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:54670: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
description:
Feb  4 06:44:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Feb  4 06:45:11 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-04 06:44:52 dovecot_plain authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:37868: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-02-04 06:44:59 dovecot_login authenticator failed for ([177.6.232.206]) [177.6.232.206]:47056: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-02-04 06:45:01 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:55645: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  4 06:45:10 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-02-04 06:45:13 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (tinessate) [92.244.126.105]:39930: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Feb  4 06:45:15 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-02-04 06:45:17 dovecot_login authenticator failed for ([220.122.115.9]) [220.122.115.9]:48907: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Feb  4 06:44:57 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Feb  4 06:44:59 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-04 06:45:12 dovecot_plain authenticator failed for ([195.222.57.182]) [195.222.57.190]:43446: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-02-04 06:46:23 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:34131: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.32.123.166
description:
[2025-02-04 06:45:41 +0100] info [webmaild] 188.32.123.166 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 06:45:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Feb  4 06:46:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-02-04 06:46:08 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:41486: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Feb  4 06:46:21 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.204.206.124
description:
[2025-02-04 06:46:11 +0100] info [webmaild] 176.204.206.124 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.155.178
description:
[2025-02-04 06:46:12 +0100] info [webmaild] 45.4.155.178 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-02-04 06:46:42 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:52490: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.218.2.154
description:
Feb  4 06:46:49 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.218.2.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.209.99.189
description:
Feb  4 06:47:05 ait sshd[3951497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.209.99.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
description:
Feb  4 06:47:27 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.209.99.189
description:
Feb  4 06:47:05 ait sshd[3951497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.209.99.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Feb  4 06:46:40 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.159.206
description:
[2025-02-04 06:46:43 +0100] info [webmaild] 170.239.159.206 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.218.2.154
description:
2025-02-04 06:46:51 dovecot_plain authenticator failed for (host-196.218.2.154-static.tedata.net) [196.218.2.154]:40861: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
description:
2025-02-04 06:47:29 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:54040: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-02-04 06:47:55 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:54458: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
description:
Feb  4 06:48:03 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.13.143
description:
Feb  4 06:48:14 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.13.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.13.145.118
description:
Feb  4 06:48:16 ait sshd[3952076]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.13.145.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-04 06:47:49 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:54999: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
description:
Feb  4 06:47:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-02-04 06:47:55 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:14786: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.6.55.57
description:
Feb  4 06:48:23 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.6.55.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-02-04 06:47:51 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:41892: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-02-04 06:48:00 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:35536: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Feb  4 06:48:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.163.103
description:
Feb  4 06:47:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.163.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
description:
2025-02-04 06:47:45 dovecot_plain authenticator failed for (eplismets) [65.20.163.103]:46438: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  4 06:47:47 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.13.143
description:
2025-02-04 06:48:16 dovecot_plain authenticator failed for ([39.152.13.143]) [39.152.13.143]:48987: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-02-04 06:48:18 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:57024: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Feb  4 06:48:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.89.159.59
description:
Feb  4 06:47:40 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.89.159.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.205.249
description:
Feb  4 06:47:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.205.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Feb  4 06:48:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  4 06:48:03 ait sshd[3952042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
description:
2025-02-04 06:47:54 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:33576: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Feb  4 06:47:58 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.205.249
description:
2025-02-04 06:47:56 dovecot_plain authenticator failed for ([175.207.205.249]) [175.207.205.249]:46714: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.215.60
description:
2025-02-04 06:47:57 dovecot_plain authenticator failed for ([175.207.215.60]) [175.207.215.60]:60560: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
description:
2025-02-04 06:48:05 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:56022: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.215.60
description:
Feb  4 06:47:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.215.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-02-04 06:48:02 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:54640: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.19.107.198
description:
Feb  4 06:48:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.19.107.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.19.107.198
description:
2025-02-04 06:48:09 dovecot_plain authenticator failed for ([219.140.170.34]) [27.19.107.198]:62044: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-02-04 06:48:09 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:32794: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.13.145.118
description:
Feb  4 06:48:16 ait sshd[3952076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.13.145.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
description:
2025-02-04 06:48:25 dovecot_plain authenticator failed for ([119.6.55.57]) [119.6.55.57]:35066: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Feb  4 06:47:49 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Feb  4 06:47:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  4 06:48:03 ait sshd[3952042]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-02-04 06:48:33 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:58911: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Feb  4 06:48:00 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Feb  4 06:48:16 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.8.201
description:
[2025-02-04 06:48:20 +0100] info [webmaild] 45.162.8.201 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
description:
2025-02-04 06:47:42 dovecot_plain authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:47968: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Feb  4 06:47:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.209.99.189
description:
Feb  4 06:48:47 ait sshd[3952279]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.209.99.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.132.164
description:
Feb  4 06:49:26 ait sshd[3952366]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.78.132.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.78.132.164
description:
Feb  4 06:49:26 ait sshd[3952366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.78.132.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-02-04 06:48:39 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:40180: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.115.66
description:
Feb  4 06:48:55 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.115.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.13.145.118
description:
Feb  4 06:49:36 ait sshd[3952376]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.13.145.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.209.99.189
description:
Feb  4 06:48:47 ait sshd[3952279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.209.99.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.88.34
description:
[2025-02-04 06:48:49 +0100] info [webmaild] 213.230.88.34 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.37
description:
Feb  4 06:49:18 ait sshd[3952353]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.37
description:
Feb  4 06:49:18 ait sshd[3952353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.103.151
description:
[2025-02-04 06:49:21 +0100] info [webmaild] 138.185.103.151 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.13.145.118
description:
Feb  4 06:49:36 ait sshd[3952376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.13.145.118  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.186.83.206
description:
[2025-02-04 06:48:48 +0100] info [webmaild] 185.186.83.206 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.56.115.66
description:
2025-02-04 06:48:57 dovecot_plain authenticator failed for ([103.56.115.66]) [103.56.115.66]:43738: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.144.82.250
description:
Feb  4 06:49:41 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.144.82.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Feb  4 06:49:51 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.162.195
description:
2025-02-04 06:49:58 dovecot_plain authenticator failed for ([27.71.162.195]) [27.71.162.195]:48752: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-02-04 06:50:06 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:53570: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.73.22.66
description:
Feb  4 06:50:12 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.73.22.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.73.22.66
description:
2025-02-04 06:50:14 dovecot_login authenticator failed for ([186.73.22.66]) [186.73.22.66]:52516: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Feb  4 06:49:39 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-02-04 06:49:53 dovecot_login authenticator failed for ([58.16.49.250]) [58.16.49.250]:50284: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.209.99.189
description:
Feb  4 06:49:59 ait sshd[3952566]: Failed password for invalid user user from 162.209.99.189 port 34226 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
description:
2025-02-04 06:50:07 dovecot_plain authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:49375: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.162.195
description:
Feb  4 06:49:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.162.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.5.159.34
description:
Feb  4 06:49:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.5.159.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.209.99.189
description:
Feb  4 06:49:57 ait sshd[3952566]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.209.99.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
description:
Feb  4 06:50:05 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-02-04 06:50:24 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:46453: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.144.82.250
description:
2025-02-04 06:49:43 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:48992: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-49.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.209.99.189
description:
Feb  4 06:49:57 ait sshd[3952566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.209.99.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Feb  4 06:50:04 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.133.6
description:
Feb  4 06:50:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.133.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Feb  4 06:50:22 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-02-04 06:49:41 dovecot_login authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:42766: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Feb  4 06:49:48 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-02-04 06:49:50 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:39308: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.5.159.34
description:
2025-02-04 06:49:56 dovecot_login authenticator failed for ([45.5.159.34]) [45.5.159.34]:39500: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.60.225
description:
47.128.60.225 - - [04/Feb/2025:06:50:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10044976 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C61%2C30&filter_course-language=95&filtering=1&instructor=1&price_type=paid&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.60.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
description:
2025-02-04 06:50:39 dovecot_plain authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:37385: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.246.244
description:
[2025-02-04 06:50:50 +0100] info [webmaild] 168.196.246.244 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  4 06:50:58 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-02-04 06:50:58 dovecot_plain authenticator failed for ([123.142.230.50]) [123.142.230.50]:38220: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.39.165
description:
2025-02-04 06:51:09 dovecot_login authenticator failed for ([185.232.39.165]) [185.232.39.165]:47148: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Feb  4 06:50:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-04 06:51:00 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:50297: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.215.161.68
description:
[2025-02-04 06:51:17 +0100] info [webmaild] 179.215.161.68 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.39.165
description:
Feb  4 06:51:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.39.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.157.252
description:
[2025-02-04 06:51:19 +0100] info [webmaild] 138.185.157.252 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.166.73
description:
Feb  4 06:51:28 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.166.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
description:
2025-02-04 06:51:30 dovecot_login authenticator failed for ([117.158.166.73]) [117.158.166.73]:10916: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.90.150.51
description:
2025-02-04 06:52:31 dovecot_plain authenticator failed for ip-109-090-150-051.um36.pools.vodafone-ip.de [109.90.150.51]:56900: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.183.247
description:
2025-02-04 06:52:33 dovecot_plain authenticator failed for ([207.188.183.247]) [207.188.183.247]:41158: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.168.226
description:
Feb  4 06:51:45 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
description:
2025-02-04 06:52:03 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.147.184]:47637: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.163.125.51
description:
Feb  4 06:52:25 ait sshd[3953518]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.163.125.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.90.150.51
description:
Feb  4 06:52:29 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.90.150.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.163.125.51
description:
Feb  4 06:52:25 ait sshd[3953518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.163.125.51  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-02-04 06:52:35 dovecot_login authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:35167: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.212.215.43
description:
[2025-02-04 06:51:49 +0100] info [webmaild] 146.212.215.43 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-02-04 06:52:14 dovecot_plain authenticator failed for (95.0.252.72.static.ttnet.com.tr) [95.0.252.72]:55616: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.183.247
description:
Feb  4 06:52:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.183.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.119.194
description:
Feb  4 06:51:44 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
description:
Feb  4 06:52:01 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Feb  4 06:52:12 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Feb  4 06:52:33 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.119.194
description:
2025-02-04 06:51:46 dovecot_login authenticator failed for ([113.57.119.194]) [113.57.119.194]:28026: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
description:
2025-02-04 06:51:47 dovecot_login authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:59508: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  4 06:52:03 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-04 06:52:05 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:38835: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-04 06:53:21 dovecot_plain authenticator failed for ([179.181.135.1]) [179.181.133.153]:49510: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Feb  4 06:52:42 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
description:
Feb  4 06:52:43 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-02-04 06:52:44 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:58069: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
description:
2025-02-04 06:52:45 dovecot_plain authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:44222: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  4 06:53:10 ait sshd[3953875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-02-04 06:52:48 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:53054: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  4 06:52:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Feb  4 06:52:59 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 06:53:00 ait sshd[3953831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 06:53:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 06:53:00 ait sshd[3953831]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-04 06:53:01 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:58545: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  4 06:53:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.177.137.154
description:
[2025-02-04 06:53:20 +0100] info [webmaild] 160.177.137.154 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Feb  4 06:52:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  4 06:53:10 ait sshd[3953875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.23.248.82
description:
[2025-02-04 06:54:04 +0100] info [webmaild] 177.23.248.82 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
description:
2025-02-04 06:54:32 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:63072: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
description:
Feb  4 06:54:30 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.129.73.169
description:
[2025-02-04 06:53:50 +0100] info [webmaild] 186.129.73.169 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  4 06:54:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-04 06:54:15 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:48284: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-02-04 06:55:28 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:48652: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.132.164
description:
Feb  4 06:55:36 ait sshd[3954592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.78.132.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Feb  4 06:55:04 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-02-04 06:55:10 dovecot_plain authenticator failed for (95.0.252.72.static.ttnet.com.tr) [95.0.252.72]:56572: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
description:
2025-02-04 06:55:18 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:49306: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  4 06:55:24 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-04 06:55:26 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:50030: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Feb  4 06:55:28 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-02-04 06:55:30 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:36205: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-02-04 06:55:06 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:44619: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.193.78
description:
2025-02-04 06:55:14 dovecot_login authenticator failed for ([121.188.193.78]) [121.188.193.78]:48229: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.78
description:
Feb  4 06:55:13 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.251.49.106
description:
2025-02-04 06:55:02 dovecot_login authenticator failed for 116-251-49-106.pool.activ8me.net.au [116.251.49.106]:49798: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
description:
Feb  4 06:55:16 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.78
description:
2025-02-04 06:55:15 dovecot_plain authenticator failed for ([39.152.196.78]) [39.152.196.78]:41889: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Feb  4 06:55:19 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-02-04 06:55:24 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:42140: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.78.132.164
description:
Feb  4 06:55:36 ait sshd[3954592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.78.132.164  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.209.18
description:
2025-02-04 06:55:04 dovecot_plain authenticator failed for bb121-7-209-18.singnet.com.sg [121.7.209.18]:33447: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Feb  4 06:55:08 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-02-04 06:55:12 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:48828: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
description:
Feb  4 06:55:24 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-02-04 06:55:18 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:57824: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Feb  4 06:55:22 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-02-04 06:55:21 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:44684: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Feb  4 06:55:26 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Feb  4 06:55:10 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.193.78
description:
Feb  4 06:55:12 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.193.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Feb  4 06:55:16 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
description:
2025-02-04 06:55:26 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:41117: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.209.18
description:
Feb  4 06:55:02 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.209.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.82.203.55
description:
[2025-02-04 06:54:40 +0100] info [webmaild] 103.82.203.55 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.251.49.106
description:
Feb  4 06:55:00 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.251.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-02-04 06:56:07 dovecot_login authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:52965: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
description:
2025-02-04 06:56:08 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:38936: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-02-04 06:56:37 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:49247: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
description:
2025-02-04 06:55:58 dovecot_login authenticator failed for ([67.55.189.215]) [67.55.189.215]:44515: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
description:
Feb  4 06:56:14 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Feb  4 06:56:05 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.112.159
description:
Feb  4 06:56:06 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.112.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.14.138
description:
[2025-02-04 06:56:16 +0100] info [webmaild] 179.49.14.138 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Feb  4 06:56:35 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.232.37.229
description:
[2025-02-04 06:56:37 +0100] info [webmaild] 45.232.37.229 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-04 06:56:16 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:56047: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.117.87
description:
[2025-02-04 06:55:46 +0100] info [webmaild] 45.226.117.87 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
description:
Feb  4 06:55:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.66.190.67
description:
Feb  4 06:56:54 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.66.190.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
description:
2025-02-04 06:56:56 dovecot_plain authenticator failed for ([116.66.190.67]) [116.66.190.67]:45358: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.195.217.94
description:
Feb  4 06:56:51 ait sshd[3954860]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.195.217.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.195.217.94
description:
Feb  4 06:56:51 ait sshd[3954860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.195.217.94  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.7.126.103
description:
[2025-02-04 06:57:11 +0100] info [webmaild] 189.7.126.103 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.53.65.34
description:
[2025-02-04 06:58:18 +0100] info [webmaild] 177.53.65.34 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.30.3
description:
2025-02-04 06:59:17 dovecot_login authenticator failed for ([121.162.30.3]) [121.162.30.3]:60233: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.63.212
description:
2025-02-04 06:59:27 dovecot_login authenticator failed for ([202.156.63.212]) [202.156.63.212]:54194: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.132.164
description:
Feb  4 06:59:29 ait sshd[3955913]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.78.132.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  4 06:59:11 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.162.30.3
description:
Feb  4 06:59:15 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.162.30.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
description:
2025-02-04 06:58:50 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:49168: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.94.149.185
description:
[2025-02-04 06:59:25 +0100] info [webmaild] 178.94.149.185 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Feb  4 06:58:53 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-04 06:59:36 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:42356: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-04 06:59:13 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:44305: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Feb  4 06:59:14 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-02-04 06:59:16 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:52885: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 06:59:18 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.238.90
description:
Feb  4 06:59:00 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.238.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.238.90
description:
2025-02-04 06:59:02 dovecot_plain authenticator failed for ([122.187.147.17]) [128.185.238.90]:39590: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.246.33
description:
2025-02-04 06:59:09 dovecot_plain authenticator failed for ([14.48.246.33]) [14.48.246.33]:57594: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
description:
Feb  4 06:58:48 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.161.58
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS24A00072Y||WPU:ADS24A00072Y||RSV:6.65||T:APACHE||MV:06-59.45.61.161.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  4 06:59:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.156.63.212
description:
Feb  4 06:59:25 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.156.63.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.226.88.227
description:
[2025-02-04 06:58:48 +0100] info [webmaild] 105.226.88.227 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-02-04 06:58:55 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:60784: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.246.33
description:
Feb  4 06:59:07 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.246.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.78.132.164
description:
Feb  4 06:59:29 ait sshd[3955913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.78.132.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-04 06:59:48 dovecot_login authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:46589: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
description:
2025-02-04 07:00:33 dovecot_plain authenticator failed for ([60.172.54.36]) [60.172.54.36]:44721: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.230.179
description:
Feb  4 06:59:45 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.230.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-02-04 07:00:31 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:21867: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.103.215
description:
Feb  4 07:00:34 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.122.103.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 66.63.187.168
domain: 136.243.145.84
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.111.43
description:
[2025-02-04 07:00:00 +0100] info [webmaild] 170.254.111.43 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Feb  4 07:00:29 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.54.36
description:
Feb  4 07:00:31 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.54.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  4 06:59:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.103.215
description:
2025-02-04 07:00:36 dovecot_plain authenticator failed for ([222.122.103.215]) [222.122.103.215]:60223: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
description:
2025-02-04 06:59:47 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:37711: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
description:
Feb  4 07:00:05 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
description:
2025-02-04 07:00:07 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:53370: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-02-04 07:00:48 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:39609: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.163.125.51
description:
Feb  4 07:01:31 ait sshd[3956883]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.163.125.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.163.125.51
description:
Feb  4 07:01:31 ait sshd[3956883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.163.125.51


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.199.59
description:
[2025-02-04 07:00:42 +0100] info [webmaild] 170.245.199.59 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  4 07:00:44 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-04 07:00:46 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:58378: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.56.161
description:
[2025-02-04 07:01:11 +0100] info [webmaild] 131.255.56.161 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
description:
Feb  4 07:00:42 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
description:
2025-02-04 07:00:44 dovecot_plain authenticator failed for syn-047-037-177-099.res.spectrum.com [47.37.177.99]:49398: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Feb  4 07:00:46 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 07:00:48 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Feb  4 07:00:56 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-02-04 07:00:58 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:34964: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
description:
Feb  4 07:02:22 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
description:
2025-02-04 07:02:24 dovecot_login authenticator failed for ([1.26.70.70]) [1.26.70.70]:58730: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.95.223.139
description:
2025-02-04 07:02:01 dovecot_login authenticator failed for ([36.95.223.139]) [36.95.223.139]:52481: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.64.146
description:
Feb  4 07:02:05 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.64.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.97.64.146
description:
2025-02-04 07:02:07 dovecot_login authenticator failed for 138-97-64-146.westlink.net.br [138.97.64.146]:50692: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-02-04 07:02:14 dovecot_login authenticator failed for ([121.202.153.186]) [121.202.153.186]:23815: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.95.223.139
description:
Feb  4 07:01:59 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.95.223.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.58.93
description:
[2025-02-04 07:02:06 +0100] info [webmaild] 45.4.58.93 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Feb  4 07:02:12 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
description:
Feb  4 07:02:37 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
description:
2025-02-04 07:02:44 dovecot_login authenticator failed for ([61.189.61.162]) [61.189.61.162]:51254: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
description:
Feb  4 07:03:18 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.25.70
description:
Feb  4 07:03:21 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.25.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.55.110.191
description:
[2025-02-04 07:02:39 +0100] info [webmaild] 187.55.110.191 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
description:
Feb  4 07:03:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
description:
2025-02-04 07:02:54 dovecot_login authenticator failed for (ANO-SH-21.Moscow.access.comstar.ru) [83.237.42.54]:34464: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
description:
Feb  4 07:03:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
description:
2025-02-04 07:03:09 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:53182: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.9.62
description:
[2025-02-04 07:03:14 +0100] info [webmaild] 131.255.9.62 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-02-04 07:03:26 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:53907: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.189.61.162
description:
Feb  4 07:02:42 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.189.61.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
description:
Feb  4 07:02:52 ait auth[3937576]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
description:
Feb  4 07:03:04 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
description:
2025-02-04 07:03:06 dovecot_login authenticator failed for ([129.204.108.172]) [129.204.108.172]:41444: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-04 07:03:20 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:45991: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.25.70
description:
2025-02-04 07:03:23 dovecot_login authenticator failed for ([39.129.25.70]) [39.129.25.70]:58096: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Feb  4 07:03:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
description:
2025-02-04 07:03:37 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:58054: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-02-04 07:02:39 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:26219: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Feb  4 07:04:16 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-04 07:04:35 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:44731: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
description:
Feb  4 07:04:08 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-02-04 07:04:18 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:56084: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Feb  4 07:04:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Feb  4 07:04:34 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Feb  4 07:03:41 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 07:03:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.139.182.85
description:
Feb  4 07:04:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.139.182.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-02-04 07:04:04 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:46938: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
description:
2025-02-04 07:04:10 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:58072: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-04.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-02-04 07:04:36 dovecot_login authenticator failed for ([110.182.203.89]) [110.182.203.89]:42894: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.183.202.248
description:
[2025-02-04 07:03:44 +0100] info [webmaild] 190.183.202.248 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Feb  4 07:04:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.139.182.85
description:
2025-02-04 07:04:16 dovecot_login authenticator failed for ([43.139.182.85]) [43.139.182.85]:43670: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-02-04 07:04:24 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:51490: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  4 07:04:33 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-02-04 07:03:43 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:55517: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
description:
Feb  4 07:04:51 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-02-04 07:04:51 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:60359: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.237.8.101
description:
[2025-02-04 07:05:13 +0100] info [webmaild] 190.237.8.101 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.250.81.177
description:
Feb  4 07:04:42 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.250.81.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Feb  4 07:04:49 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 07:05:26 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-02-04 07:04:43 dovecot_plain authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:34628: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Feb  4 07:05:04 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Feb  4 07:05:17 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-02-04 07:05:06 dovecot_login authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:44366: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-02-04 07:05:06 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:37742: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-02-04 07:05:19 dovecot_login authenticator failed for ([123.214.65.245]) [123.214.65.245]:35658: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.1.7
description:
[2025-02-04 07:04:39 +0100] info [webmaild] 177.8.1.7 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Feb  4 07:04:41 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.250.81.177
description:
2025-02-04 07:04:44 dovecot_plain authenticator failed for ([183.250.81.177]) [183.250.81.177]:47272: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-02-04 07:04:53 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:36324: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
description:
2025-02-04 07:05:44 dovecot_login authenticator failed for ([65.20.169.151]) [65.20.169.151]:39610: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.189.43.218
description:
[2025-02-04 07:06:28 +0100] info [webmaild] 181.189.43.218 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.121.94.221
description:
[2025-02-04 07:05:58 +0100] info [webmaild] 94.121.94.221 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
description:
Feb  4 07:05:42 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Feb  4 07:05:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-02-04 07:05:55 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:11677: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
description:
Feb  4 07:07:00 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Feb  4 07:07:32 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Feb  4 07:06:39 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
description:
2025-02-04 07:07:02 dovecot_login authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:53974: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
description:
2025-02-04 07:07:12 dovecot_login authenticator failed for ([222.132.167.110]) [222.132.167.110]:52520: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.110.100.232
description:
[2025-02-04 07:07:20 +0100] info [webmaild] 179.110.100.232 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-02-04 07:06:41 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:54548: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-02-04 07:07:34 dovecot_login authenticator failed for ([14.37.125.43]) [14.37.125.43]:41807: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
description:
Feb  4 07:06:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
description:
2025-02-04 07:06:54 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:64977: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
description:
Feb  4 07:07:10 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.222.203.52
description:
Feb  4 07:07:50 ait sshd[3959372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.222.203.52


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Feb  4 07:08:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.227.217.50
description:
[2025-02-04 07:08:22 +0100] info [webmaild] 186.227.217.50 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
description:
Feb  4 07:08:37 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Feb  4 07:07:42 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.124.218
description:
[2025-02-04 07:07:52 +0100] info [webmaild] 169.224.124.218 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-02-04 07:07:48 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:54602: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
description:
2025-02-04 07:07:49 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:52341: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
description:
Feb  4 07:07:59 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.108.46
description:
Feb  4 07:08:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.108.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.108.46
description:
2025-02-04 07:08:09 dovecot_plain authenticator failed for ([212.90.108.46]) [212.90.108.46]:47511: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Feb  4 07:07:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-02-04 07:07:48 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:45372: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
description:
Feb  4 07:08:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
description:
2025-02-04 07:08:16 dovecot_plain authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:44337: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-02-04 07:07:44 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:54126: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
description:
Feb  4 07:07:47 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-02-04 07:08:01 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:52028: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-02-04 07:08:04 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:64490: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.220
description:
Feb  4 07:08:12 ait sshd[3959868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.220  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.222.203.52
description:
Feb  4 07:07:50 ait sshd[3959372]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.222.203.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.220
description:
Feb  4 07:08:12 ait sshd[3959868]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Feb  4 07:07:46 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Feb  4 07:09:15 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.253.217.233
description:
[2025-02-04 07:08:52 +0100] info [webmaild] 188.253.217.233 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-02-04 07:08:54 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:42256: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  4 07:09:02 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-02-04 07:09:26 dovecot_login authenticator failed for ([124.132.61.213]) [124.132.61.213]:38986: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
description:
2025-02-04 07:08:39 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:36890: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Feb  4 07:08:52 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Feb  4 07:09:01 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-02-04 07:09:03 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.50]:48217: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-04 07:09:04 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:59654: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 07:09:36 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 41.216.188.18
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:administrator||WPU:administrator||RSV:6.65||T:APACHE||MV:07-08.41.216.188.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Feb  4 07:09:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-02-04 07:09:17 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:51490: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.10.142.231
description:
[2025-02-04 07:09:56 +0100] info [webmaild] 190.10.142.231 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Feb  4 07:10:33 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.163.125.51
description:
Feb  4 07:10:10 ait sshd[3960662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.163.125.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.222.84
description:
Feb  4 07:10:17 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.222.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.222.84
description:
2025-02-04 07:10:19 dovecot_plain authenticator failed for ([183.234.222.84]) [183.234.222.84]:59834: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.193.103.213
description:
Feb  4 07:10:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.193.103.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-02-04 07:10:35 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:50908: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.163.125.51
description:
Feb  4 07:10:10 ait sshd[3960662]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.163.125.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
description:
Feb  4 07:10:22 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.193.103.213
description:
2025-02-04 07:10:24 dovecot_plain authenticator failed for ([104.193.103.213]) [104.193.103.213]:41842: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-02-04 07:09:43 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:45738: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
description:
2025-02-04 07:10:24 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:48202: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.150.18
description:
[2025-02-04 07:10:31 +0100] info [webmaild] 45.160.150.18 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 07:10:55 ait sshd[3960866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-02-04 07:11:06 dovecot_plain authenticator failed for (cumanify) [93.159.152.6]:33682: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-02-04 07:10:42 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:43593: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 07:10:55 ait sshd[3960866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Feb  4 07:11:04 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 07:11:24 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.33.207.90
description:
[2025-02-04 07:11:32 +0100] info [webmaild] 187.33.207.90 - mail@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Feb  4 07:10:40 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.45.134.3
description:
[2025-02-04 07:11:01 +0100] info [webmaild] 5.45.134.3 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
description:
2025-02-04 07:11:58 dovecot_login authenticator failed for ([218.25.233.2]) [218.25.233.22]:33689: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  4 07:12:06 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-02-04 07:12:09 dovecot_login authenticator failed for (tagsdev.click) [199.188.103.179]:56720: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.222.203.52
description:
Feb  4 07:11:44 ait sshd[3961178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.222.203.52


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Feb  4 07:12:07 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-04 07:12:08 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:14475: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-04 07:12:37 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:42186: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.212.116
description:
Feb  4 07:11:44 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.212.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.222.203.52
description:
Feb  4 07:11:44 ait sshd[3961178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.222.203.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.233.22
description:
Feb  4 07:11:56 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.233.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
description:
Feb  4 07:12:14 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Feb  4 07:12:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.212.116
description:
2025-02-04 07:11:46 dovecot_login authenticator failed for ([5.77.212.116]) [5.77.212.116]:36567: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-04 07:12:16 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:56255: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.74.49.99
description:
[2025-02-04 07:12:29 +0100] info [webmaild] 41.74.49.99 - mail@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  4 07:12:35 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-02-04 07:12:37 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:41520: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.222.203.52
description:
Feb  4 07:13:33 ait sshd[3961840]: pam_imunify(sshd:auth): [IM360_RBL] The IP 129.222.203.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Feb  4 07:13:28 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.106.145.230
description:
[2025-02-04 07:13:03 +0100] info [webmaild] 85.106.145.230 - mail@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.222.203.52
description:
Feb  4 07:13:36 ait sshd[3961840]: Failed password for invalid user odoo15 from 129.222.203.52 port 1546 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Feb  4 07:12:43 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-02-04 07:12:55 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:43812: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 129.222.203.52
description:
Feb  4 07:13:33 ait sshd[3961840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.222.203.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-02-04 07:12:45 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:53856: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-02-04 07:13:30 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:55244: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-02-04 07:13:03 dovecot_plain authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:55984: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  4 07:13:17 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-04 07:13:19 dovecot_login authenticator failed for ([121.202.154.173]) [121.202.154.173]:38981: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.53.253
description:
[2025-02-04 07:13:35 +0100] info [webmaild] 143.255.53.253 - mail@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Feb  4 07:12:53 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Feb  4 07:13:01 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
description:
2025-02-04 07:14:33 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:34877: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
description:
Feb  4 07:14:37 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.194.9.65
description:
Feb  4 07:13:40 ait auth[3957554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.194.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.194.9.65
description:
2025-02-04 07:13:42 dovecot_login authenticator failed for syn-024-194-009-065.res.spectrum.com [24.194.9.65]:37545: 535 Incorrect authentication data (set_id=botchway)


